Retest and remediation window planner
Most included retests expire 30 to 90 days after the report, and most teams find out by missing it. Give this five answers and it gives you the two dates that matter, on screen, with no email asked for.
A penetration test retest is normally included in the fee, and normally only for a fixed period after the report. The date that period ends is the real deadline for your engineering team, and it is almost never the date anyone writes in a ticket. This works out that date, the day the fixes have to ship to make it, and the day you should be booking the retest.
Nothing is emailed anywhere unless you ask for it at the end. The dates appear on this page.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
How the dates are worked out
The deadline is your start date plus the window, and everything else works backwards from it. The booking date is two weeks earlier. Firms schedule testers in advance, and a retest requested on the last day of the window happens outside it. The ship-by date is a further week earlier, so a fix that does not survive contact with production still has room for a second attempt.
Release cadence is in the calculation because it is the constraint people forget. A team on a quarterly release train with a 30 day window cannot ship fixes inside the window at all. That is arithmetic, not a failure of effort. Negotiate the window at quote time, which is one of the terms listed on choosing a Canadian testing firm.
What this does not do
It does not tell you how long a fix takes. That depends on the finding, and an authorisation model that was wrong from the start is months of work while a missing header is an afternoon. It also assumes one retest. If your contract allows several, the deadline still applies and the pressure is lower. The argument for treating the retest as part of the purchase rather than an extra is on retest and remediation verification.
Common questions
My contract does not mention a retest at all. What should I assume?
Assume there is none and ask in writing. A firm that includes one will say so immediately. A firm that does not will quote $1,500 to $6,000 CAD depending on whether you retest everything or only the high and critical findings. Get that in writing before you compare the quote against one that includes a retest, because otherwise you are comparing two different products.
Does the window start at the draft report or the final one?
It varies by contract and the difference is often two weeks, because report writing takes that long. Where both exist, ask which one starts the clock and get the answer in writing. If nobody will commit, plan from the earlier date and treat the extra time as a buffer you did not count on.
Can we extend the window?
Often, if you ask before it closes rather than after. Firms would rather move a date than lose next year's engagement. What rarely works is asking two months late with an auditor waiting, because by then the tester who did the work has moved on and someone has to read the report from scratch.
What if we cannot fix everything in time?
Retest what you fixed and document the rest as an accepted risk, approved by someone senior enough to accept it, with a date for revisiting. A partial retest plus a written acceptance is normal evidence and auditors handle it routinely. Silence on an open high finding is the thing that causes trouble.
Buying the test now rather than planning one you have
Tell us the scope and ask for the retest window up front, and the request goes to Canadian firms with those terms stated.
Get matched