Yes, the idea was to make a commitment that would then be hard to avoid. They can fire you I guess, but it's a reasonable course of action to get some pen testing in place.