Compliance Wired Network Testing

Objectives
• Obtain an independent, manual penetration test to validate the security of the Selcomm platform and the isolation of customer environments.
• Produce a formal report (with a redactable version) to evidence security assurance to enterprise customers.
Environment (context)
Solution: Selcomm billing platform — dedicated (non-cloud) software; virtualised Windows + Linux/Informix
Hosting: Production: NTT data centre.
Access/interfaces: Per-customer dedicated VLANs; site-to-site VPN; SSL/TLS and sFTP. No wireless
Target list / scope (please price individually and combined)
• A — External infrastructure: internet-facing VPN endpoint(s), any public web/portal, mail gateway.
• B — Web application: authenticated & unauthenticated test of the Selcomm application / customer portal.
• C — Internal / segmentation: validate isolation of the dedicated per-customer VLAN (no lateral access between clients).
Rules of engagement
• Select Software systems only; customer systems and the far side of any VPN are out of scope.
• Written authorisation from hosting providers (NTT) obtained by Select Software before testing — advise required lead time.
• Agreed test window, named emergency contacts and a stop procedure. Mutual NDA before detailed scoping.
Provider requirements
• CREST-accredited firm; assigned testers holding OSCP and/or CREST CRT (or higher). List tester certifications.
• Australian-based delivery and data residency; current PI/public liability insurance; two comparable references.
Deliverables & commercials
• Report: executive summary, methodology, CVSS-rated findings with evidence, prioritised remediation; plus a retest and attestation letter.
• Fixed-price quote per scope (A/B/C) and combined, incl. scoping call, testing, reporting and one retest; quote validity; earliest test window.