CompTIA PenTest+ (PT0-003)Engagement ManagementEasy
A penetration testing firm requires both parties to sign a document before any engagement details are discussed, legally binding them to protect confidential information (such as network diagrams, findings, and client business data) from unauthorized disclosure. Which document is this?
- ARules of Engagement (RoE)
- BStatement of Work (SOW)
- CMaster Service Agreement (MSA)
- DNon-Disclosure Agreement (NDA)
Show answer & explanationAnswer & explanation
Correct answer: D. Non-Disclosure Agreement (NDA)
An NDA is specifically designed to protect confidential information shared between parties before, during, and after an engagement. The SOW defines work scope, the MSA governs the overall business relationship, and the RoE defines testing constraints.
Why the other options are wrong
- A. RoE defines testing boundaries, techniques, and timing, not confidentiality.
- B. SOW defines the specific work, deliverables, and timeline, not confidentiality.
- C. MSA sets overall legal/business terms for the relationship, not solely confidentiality.
Non-Disclosure Agreement (NDA)
A legal contract that obligates parties to protect and not disclose confidential information exchanged during an engagement.
- Signed before sensitive discussions/testing begins
- Can be mutual (both parties) or one-way
- Breach can result in legal liability
Memory trick: NDA = 'No Divulging Allowed'