Statement of Work — Sovereign Shield Deployment
Darkhorse HQ · United Kingdom · darkhorsehq.co.uk · Document ref: SS-SOW-[YYYY-MM]
1. Parties
Client (legal name)
Service provider
2. Objective
Deploy the Sovereign Shield package: edge WAF hardening (Cloudflare), public web posture audit, and live security telemetry with SIEM alerting (agent or log forwarder to agreed manager), aligned to Darkhorse HQ’s proven monitoring playbook.
3. Scope of work
3.1 Edge perimeter
- DNS cutover / proxy configuration via Cloudflare (or agreed CDN).
- WAF rules: OWASP baseline, bot/scrape mitigation, geo/rate limits as scoped.
- TLS mode review (Full Strict where applicable).
3.2 Posture audit
- HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) on origin/app.
- SSL/TLS configuration review on public endpoints.
- Baseline external vulnerability / misconfiguration check (non-intrusive).
3.3 Telemetry & alerting
- Deploy log forwarder or lightweight agent; ingest web/app security logs.
- Configure custom rules for brute force, malware signatures, and anomaly patterns.
- Validate alert delivery (email/dashboard) with test events.
- Handover: runbook for reading alerts and escalation path.
3.4 Optional — Tier 3 application hardening (custom app / commerce; fee quoted separately, typically £450–£850 add-on)
- CSRF tokens on state-changing forms (server-validated).
- CSP refinement: reduce
unsafe-inline; nonces or hashes where feasible. - Stripe (or agreed PSP) webhook verification, idempotent handlers, test/live separation.
- Cloudflare Turnstile on public forms and authentication paths.
- DNSSEC enablement at registrar for in-scope hostnames (client DNS owner required).
- Backup scope documentation and one supervised restore test with written evidence.
Out of scope (unless added in writing): 24/7 SOC staffing, full code remediation beyond scoped controls, penetration test retainer, legal/compliance certification, hosted SIEM manager SLA beyond agreed hosting terms.
4. Client responsibilities
- DNS/registrar access, Cloudflare account (or delegate access).
- Origin/server or PaaS access for header and agent/forwarder configuration.
- Named technical contact for change windows.
- Accurate description of applications in scope (domains, environments).
5. Deliverables
- Configuration summary (edge + origin).
- Posture audit findings (prioritized).
- Telemetry integration diagram and alert catalogue.
- 30-minute handover session (recorded if client requests).
6. Timeline
Target start
Estimated duration
7. Commercial terms
| Item | Amount (GBP) | Notes |
|---|---|---|
| One-time setup & hardening | [650 – 950 per calculator / quote] | Due [50% on signature / 50% on completion — choose terms] |
| Optional advisory retainer | £150 / month | Monthly log review, minor rule tuning, advisory availability — [Y/N] |
Prices exclude VAT if applicable. Expenses pre-approved in writing only.
8. Incident advisory (optional add-on)
Emergency triage (first 2 hours): indicative £250, subject to availability. Major IR handoff brokered separately with disclosed referral/advisory fees where applicable.
9. Data protection
Log data processed under UK GDPR / ICO expectations. Client retains ownership of logs; Darkhorse HQ acts as processor for deployment and advisory services. DPA available on request.
10. Acceptance
Work accepted when deliverables in §5 are provided and critical alerts verified in client-visible dashboard or agreed channel.
Name: _________________________ Date: __________
Name: _________________________ Date: __________