PTaaS Evaluation
and Scoping Template
One word covers everything from a quarterly retest to a test triggered by every deployment. Two providers can describe themselves in identical language and be selling different products at the same price. This is the worksheet that makes them answer the same questions in the same order.
PTaaS Evaluation and Scoping Template
Enter your work email for the printable worksheet — the questions that pin down what “continuous” commits a provider to, the verification gate, the coverage and retest tables, the reporting output an assessor consumes, and a weighted scorecard for three providers.
Check your inbox
We've emailed you a link to download PTaaS Evaluation and Scoping Template.
The link expires in 48 hours. If it hasn't arrived in a few minutes, check your spam folder.
We couldn't send the download link. Please try again, or contact us and we'll email you PTaaS Evaluation and Scoping Template.
What it pins down
Six questions whose answers differ between providers who sound the same
None of this is about whether a provider is competent — competence is established the way it always was. This is about what the subscription commits them to once the evaluation is over and the invoices are monthly.
Section 4
What the word commits them to
What event starts a test. How long the coverage cycle runs. What is tested continuously and what is tested once a year. And the one answer that cannot be given in prose — the maximum interval, in days, between two tests of the same asset.
Section 5
Automated finding versus verified finding
Two different things are called a finding: the output of a check, and a claim reproduced by a person with the steps written down. Whoever does not establish which is which pays for it every week, finding by finding.
Section 6
What happens to an asset that appears later
A point-in-time engagement never faces this. How a new asset enters scope and how fast, what happens to one discovery finds but you never declared, and whether authenticated coverage survives a credential rotation visibly or silently.
Section 7
The retest clock, and whose time it measures
Retest included, capped or billed; how many attempts before a fix costs money; what a partial fix records. And the definitions clause worth reading twice — an SLA whose clock runs on your remediation time is a metric about you.
Section 8
The document a dashboard cannot produce
A stream of findings and a dated report against a stated scope are not the same artefact, and a great many obligations consume the second. Establish that the provider produces one, what it costs, and who signs it — before signature, not after.
Section 10
The unit, and everything that moves it
Every provider prices on a unit they chose. The rows that sit outside the subscription — retests past the cap, a report on request, an attestation letter, export at the end of term — are what make two identical quotes different in year two.
Contents
Twelve sections you write in
It is a worksheet, not a guide. Every section leaves somewhere to record an answer in the provider’s own words, and it publishes a word for the awkward one — “described” and “committed” are different answers, and by the readout nobody can remember which of the two a given row was.
1
What this template is for
The difference between buying an engagement and buying a subscription, and what “committed” has to mean for the rest of the worksheet to work.
2
Programme cover sheet
The estate in your own words, the current arrangement and what it costs, the obligations the output has to satisfy, and who owns the queue.
3
A vocabulary for the answers
Five states, because the interesting answers are in the middle. “Described” and “committed” stop being the same cell.
4
What “continuous” means in this contract
Seven questions that define the word for one provider, with a column for their answer verbatim and a column for its state.
5
Automated finding versus verified finding
Twelve rows on verification, evidence, exploitability and dispute — and the two-document request that answers all of them faster.
6
Coverage model and scope change
What is in scope, how scope changes, and how authenticated testing is kept alive as credentials rotate.
7
The retest and remediation loop
Nine rows on SLA, attempts, partial fixes, finding states and who is allowed to close one.
8
Evidence and reporting output
Point-in-time report, scope statement, signature, the qualification your obligation names, retention, export, and access after termination.
9
Integration and workflow
Short on purpose. Ticketing, pipeline, notification, API, access control, residency — and a read-only account for the evaluation.
10
Commercial model
The unit, what moves it, and a priced list of what sits outside the fee — totalled at your own volumes before any subscription is compared.
11
Evaluation scorecard
Seven weighted criteria totalling 100, three provider columns, an anchored 0–5 scale, and a sheet for recording the weights before proposals arrive.
12
When a scheduled assessment is the better instrument
Seven indicators, honestly written. Two or more is not a verdict against continuous testing — it is an instruction to split the estate.
Section 12
It also tells you when a scheduled assessment is the better instrument
Continuous testing earns its price where the estate changes. Where the surface is stable between releases measured in months, the same budget buys more depth as a scheduled engagement — and depth is what finds the flaw in a business process rather than the flaw in a library version.
Coverage and depth trade against each other inside any budget. A service that touches every asset every week and an engagement that spends four weeks inside one application are both defensible purchases; they answer different questions. The expensive mistake is buying the first while expecting the second, and it takes about a year to become visible.
So the last section is seven indicators that point the other way, and the commonest good answer when two or more of them tick is a subscription over the changing part of the estate and a scheduled assessment over the part that carries the obligation — priced separately, from the same shortlist. The worksheet names no provider anywhere, including the firm that published it.
Already know which part of the estate needs which?
Describe the estate, the release rate and the date any evidence has to exist by, and you will get a straight answer on scope, cadence and cost — including where a scheduled assessment is the cheaper way to get what you actually need.
Describe your estate