What is meant by rules of engagement?
Rules of engagement (RoE) are the agreed limits for a security test: what may be tested, when, how, with what precautions, and who to call when something goes wrong. They turn a general authorization to test into specific boundaries the testers must follow. Every legitimate penetration test, red team exercise, vendor test and bug bounty program has them, and testers who step outside them are no longer covered by the agreement.
Why written authorization matters
The tools and techniques of a penetration test are the same ones attackers use. The difference is permission. Unauthorized access to computer systems is a crime under laws such as the U.S. Computer Fraud and Abuse Act, so testers need written authorization from someone with authority over the specific assets being tested. A manager cannot authorize testing of systems the organization does not own: a SaaS vendor, hosting provider or partner must give its own permission, or the test must follow that provider's published testing policy.
The stakes are real. In 2019, two testers hired by Iowa's state court administration were arrested during a nighttime physical test of a county courthouse, because county officials disputed that the state could authorize entry to the building. The charges were later dropped. The case shows why authorization has to come from whoever actually controls each asset in scope.
What rules of engagement cover
| Element | Example entry |
|---|---|
| In scope | 203.0.113.0/24, portal.example.com, headquarters floors 1 to 3 |
| Out of scope | Third-party payroll SaaS, production OT network |
| Testing window | Weeknights 18:00 to 06:00; no testing during month-end close |
| Prohibited techniques | Denial of service, destructive payloads, phishing of executives |
| Data handling | No customer records copied; prove access with screenshots; destroy captured credentials after the test |
| Reporting | Critical findings reported within 24 hours, not held for the final report |
| Stop conditions | Any outage, or signs that a real attacker is already present |
| Contacts | Client sponsor, SOC lead and test lead, with 24x7 numbers |
| Authorization | Signed and dated by the asset owner |
The stop conditions and contacts matter as much as the scope. If testers find evidence of a real compromise or another customer's data, everyone needs to know who to call and when to halt.
Physical tests and authorization letters
Physical penetration testers can be confronted by staff, guards or police, so they carry a signed authorization letter naming the client, the scope, the dates and an emergency contact who can confirm the test at any hour. Physical rules of engagement also set limits such as no forced entry, no damage to locks and no entering areas with safety hazards.
Rules of engagement vs. SOW, NDA and MSA
- Statement of work (SOW): defines the engagement's deliverables, dates and price, and usually references the rules of engagement.
- Nondisclosure agreement (NDA): keeps information shared during the test confidential.
- Master services agreement (MSA): the umbrella terms that govern all work between the two parties.
- Rules of engagement: the operational boundaries the testers follow while they test.
Rules of engagement on the CompTIA Security+ exam
Rules of engagement appear under SY0-801 objective 5.5 as part of penetration testing, and under objective 5.3 when an organization wants to test a vendor's systems. A scenario asking which document defines what testers may target, when they may test and which techniques are off limits points at the rules of engagement. A scenario in which a tester is asked to test a system the client does not own, or has no signed permission, wants the answer that stops work until written authorization is obtained from the asset owner. Distractors include the SOW, which covers deliverables and cost, the NDA, which covers confidentiality, and a SOC 2 report, which grants no permission to test anything.