CompTIA Security+ (SY0-701)Security Program Management and OversightMedium
Before beginning an authorized penetration test, the tester and client formally agree on the testing scope, permitted techniques, timing windows, and emergency contact procedures. Which document defines these parameters?
- AMaster service agreement
- BStatement of work
- CNon-disclosure agreement
- DRules of engagement
Show answer & explanationAnswer & explanation
Correct answer: D. Rules of engagement
Rules of engagement (RoE) specifically define the boundaries, techniques, timing, and escalation procedures for a penetration test, ensuring both parties agree on what is authorized before testing begins.
Why the other options are wrong
- A. An MSA establishes the general business relationship terms, not test-specific rules.
- B. A statement of work outlines deliverables and cost, not detailed testing boundaries.
- C. An NDA protects confidential information but doesn't define test scope.
Rules of Engagement (RoE)
A document that defines the scope, methods, timing, and communication procedures authorized for a penetration test.
- Prevents legal issues by defining authorization boundaries
- Includes emergency stop/contact procedures
- Distinct from SOW, which focuses on deliverables/cost
Memory trick: Rules of Engagement Set the Battlefield Boundaries