Glossary · Testing and assessment
Rules of engagement turn a simulated attack into authorised, bounded work.
The signed document that authorises a security test and sets its limits: targets, exclusions, timing, permitted techniques, contacts and what happens if something breaks.
Back to the glossary01 · In plain words
In plain words
The signed document that authorises a security test and sets its limits: targets, exclusions, timing, permitted techniques, contacts and what happens if something breaks.
Without permission, probing someone's systems can be an offence. Rules of engagement give that permission in writing and draw the lines: which addresses and applications, when, using which methods, and who to call when something goes wrong.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The document protects both sides. The tester knows exactly what is allowed; you know nothing outside scope will be touched and that a live incident will be raised immediately. NIST SP 800-115 treats this planning as part of testing itself and offers a template. Getting it wrong is costly: a test aimed at an address that belongs to a shared host or another tenant, or a load-heavy check during trading hours, causes real harm. Cloud and hosting providers also publish their own testing policies, so the rules must fit what the provider permits.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Before kick-off
- Signed by someone with authority over the systems, not just the project contact.
- The scope annex
- Hostnames, IP ranges, applications, test accounts and explicit exclusions.
- The cloud provider's testing policy
- Checked against the rules so permitted services and banned techniques line up.
- The final report
- A restatement of scope and dates, so readers know what the findings do and do not cover.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a stock-broking platform during market hours
A broking firm wants its order-entry API and client web app tested. The rules of engagement keep denial-of-service checks out entirely, limit active testing of production to after market close, and point the tester at a staging copy for anything that places orders. They name two phone contacts and a stop condition: if the tester finds evidence of a real intrusion, testing pauses and the firm's incident lead is called at once. The firm's compliance head signs as the authorising officer.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Statement of work
- The commercial agreement: deliverables, fees, timeline. The rules of engagement are the operational permission and limits for the testing itself.
- Non-disclosure agreement
- Covers confidentiality of what the tester learns. It does not authorise any testing.
- Audit scope
- What an auditor examines in a compliance engagement. Rules of engagement govern a technical test.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- List every target with its owner, and confirm you have the right to authorise testing of each one, including third-party hosted assets.
- Write the exclusions as clearly as the inclusions.
- Set timing, stop conditions, escalation contacts and how test data and credentials will be handled and destroyed.
- Check your cloud provider's testing policy and record that you did.
- GuideNetwork penetration testingTesting internal and external networks the way an intruder would approach them.
- GuideSecurity testing servicesVulnerability assessment and penetration testing, scoped to what your buyers and auditors ask for.
- GuidePenetration testing and ISO 27001What the standard expects, and what auditors accept.
Sources: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, including its rules of engagement template; PCI SSC penetration testing guidance; published penetration testing policies of the major cloud providers.
Questions about Rules of engagement
Who should sign the rules of engagement?
Someone with authority over every system in scope.
Usually a senior technical or security leader of the organisation that owns the systems. Where an asset is run by a vendor or a client, their written permission is needed too; your signature cannot authorise testing of someone else's property.
Do we need permission from AWS, Azure or Google Cloud?
Check each provider's current testing policy.
Each major provider publishes a penetration testing policy saying which services you may test on your own account and which activities, such as flooding, are banned. Read the current policy and record the check in your rules of engagement.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.