Scope and rules of engagement

Why a written agreement comes before any tool

Permission is not just a verbal "sure, go ahead". It must be specific and in writing, so that both sides know what will happen. This document is usually called the rules of engagement, or RoE. It protects the client (nothing unexpected breaks) and it protects you (you can prove you stayed inside what was agreed).

What scope means

Scope is the exact list of what you are allowed to test. It might be a set of IP addresses, a few domain names, one web application, or one office network. Anything not on the list is out of scope — you must not touch it. "In scope" and "out of scope" are the two most important phrases in a test.

A classic mistake: you are testing shop.example.com, and you notice that mail.example.com looks weak too. It is not in scope. You leave it alone and, at most, note that the client may want it tested in a future engagement. Wandering out of scope can break the client's trust and cross the legal line.

What the rules of engagement usually contain

• Who authorises the test (name, role, signature) and your contact.
• The scope: exact IPs, domains, apps, and what is explicitly out of scope.
• The time window: which dates and hours testing may happen.
• Allowed techniques: for example "no denial-of-service", "no social engineering of staff", "no changes to data".
• Handling of sensitive data found during the test.
• An emergency contact and a "stop" procedure if something goes wrong.
• How findings will be reported and to whom.

The "get out of jail" letter

Testers often carry a signed authorisation letter, sometimes called a "get out of jail free" letter, during the engagement. If a worried admin or a security guard questions what they are doing, they can show that the owner authorised it. It names the tester, the dates and the authoriser.

Changing the scope mid-test

Sometimes the client wants to add a system once the test has started. That is fine, but only after it is added to the written scope and signed off. A verbal "oh, you can test that one too" is not enough — get it in writing, even a quick email, before you touch the new system.