Statement of Work
Non-Human Identity & Secrets Sprawl Scanner
Prepared by Starks Enterprise — starksenterprise.com · Irving "Gene" Starks Jr. · [email protected] · (980) 355-9706
Purpose & Overview
Starks Enterprise will deploy a scanning solution that identifies hardcoded credentials, orphaned service accounts, over-privileged API keys, and unmanaged secrets across Client's source code repositories, CI/CD pipelines, and cloud environments, and will provide a prioritized remediation plan.
Scope of Work
Inventory of source repositories, CI/CD pipelines, and cloud accounts in scope
Deployment of secrets-scanning and non-human identity discovery tooling
Classification of findings by risk (exposed credential, excessive privilege, unrotated key, orphaned account)
Integration with Client's existing PAM/secrets manager (e.g., Vault, CyberArk, Delinea) where applicable
Prioritized remediation plan and rotation schedule
Recurring re-scan cadence configuration
Deliverables
Deployed scanning solution across in-scope repos/pipelines/cloud accounts
Findings report with risk scoring and remediation guidance
Non-human identity inventory (service accounts, API keys, tokens, certificates)
Recommended secrets-management integration plan
Recurring monthly findings report
Timeline
| Phase | Activities | Duration |
|---|---|---|
| Phase 1 | Inventory & access provisioning | 1 week |
| Phase 2 | Tool deployment & initial scan | 1-2 weeks |
| Phase 3 | Findings triage & remediation plan | 1 week |
| Phase 4 | Recurring monitoring handoff | Ongoing |
Pricing & Payment Terms
| Item | Timing | Fee |
|---|---|---|
| Initial scan, deployment & remediation plan (one-time) | Due at kickoff (50%) / delivery (50%) | $8,000 - $14,000 |
| Recurring monthly re-scan & reporting | Monthly, in advance | $500 - $1,200/mo |
| PAM/secrets-manager integration (optional) | One-time | $4,000 - $9,000 |
Invoices are due net 15. Recurring fee begins the month following initial delivery.
Client Responsibilities & Assumptions
Client will provide timely access to relevant systems, personnel, and documentation needed for discovery.
Client will designate a single point of contact for the duration of the engagement.
Cloud infrastructure costs (hosting, compute, storage) are billed separately to Client unless otherwise stated.
All work is performed remotely unless on-site work is explicitly scoped and priced separately.
Pricing assumes a single production environment and a single tenant/client instance unless stated otherwise.
Out of Scope
Remediation execution (credential rotation, code changes) beyond guidance, unless separately scoped
Scanning of repositories or systems not explicitly listed in the inventory
24/7 real-time alerting (available as an upgrade)
Acceptance Criteria
All in-scope repositories, pipelines, and cloud accounts successfully scanned
Findings report delivered and reviewed with Client stakeholders
Recurring scan schedule configured and confirmed operational
Term & Termination
This SOW is effective upon signature by both parties and remains in effect through delivery and acceptance of all deliverables, or until terminated by either party with 30 days' written notice. Fees for work performed and expenses incurred prior to termination are non-refundable. This SOW is governed by, and incorporated into, the Master Services Agreement between Starks Enterprise and Client.