Rules of Engagement
The framework that defines what is permitted during RawSecLabs security assessments. These rules protect both the tester and the client, ensuring assessments are conducted legally, ethically, and effectively.
Legal Authorization Required
A penetration test without written authorization is, legally speaking, unauthorised access. The only thing separating a contracted tester from an attacker is a signed document that says who may test what, when, and how far they may go. Every RawSecLabs engagement begins with a signed Rules of Engagement document.
What is a Rules of Engagement Document?
A Rules of Engagement (RoE) document is the written agreement between a penetration tester and the organisation being tested. It defines the boundaries of the test before any testing begins: which targets and techniques are in scope, which are explicitly out of scope, the testing window, and the constraints the tester must respect.
Critically, it contains the authorisation — sometimes called the "get-out-of-jail" statement — in which the system owner formally permits the testing activity. That signature is what makes a penetration test lawful rather than an intrusion.
Core Components of Our RoE
Scope Definition
Clear identification of in-scope assets (IP ranges, domains, applications) and explicit out-of-scope exclusions to prevent unauthorised testing.
Testing Window
Specific dates, times, and time zones when testing is permitted, with clear start and end boundaries to avoid business disruption.
Prohibited Activities
Explicit list of techniques that are not allowed (DoS, social engineering, physical access) unless separately authorised.
Emergency Contacts
24/7 contact information for both client and RawSecLabs teams to handle unexpected situations immediately.
Standard RawSecLabs RoE Framework
1. Authorization
Authorized Tester: RawSecLabs Limited and designated consultants
Client Authorization: Written authorisation from authorised signatory
Legal Basis: Contractual authorisation for security testing
Scope Owner: Designated client representative with authority over tested assets
2. Testing Scope
In-Scope Assets: Specifically listed IP ranges, domains, applications, and systems
Out-of-Scope Assets: Explicitly excluded systems, third-party services, production databases
Testing Types: Defined test methods (black-box, grey-box, white-box)
Attack Vectors: Permitted techniques and prohibited methodologies
3. Temporal Boundaries
Testing Period: Start date and end date for the engagement
Testing Hours: Permitted testing hours (e.g., 09:00-17:00 GMT)
Testing Days: Business days only vs. 24/7 testing permitted
Time Zone: All times in specified time zone (typically GMT or client local time)
4. Safety Controls
Stop Conditions: Immediate testing stop if system impact detected
Rate Limiting: Maximum request rates to avoid service disruption
Production Impact: Non-destructive testing unless explicitly authorised
Data Handling: No access to, modification, or exfiltration of production data
5. Communication Protocol
Primary Contact: Client technical lead for operational coordination
Emergency Contact: 24/7 contact for critical issues
Reporting: Critical findings reported immediately, non-critical in final report
Escalation: Defined escalation path for disputes or issues
6. Data Handling & Confidentiality
Test Data: Use of test data only, no production data access
Findings Storage: Encrypted storage of all test data and findings
Report Distribution: Limited to authorised recipients only
Data Retention: Defined retention period for test data and reports
Activities Requiring Explicit Approval
The following high-risk activities require separate, explicit written approval and are not included in standard RoE:
- Social Engineering: Phishing, vishing, or physical security testing
- Physical Access: On-site testing or physical security assessments
- Denial of Service: Any testing that could cause service disruption
- Production Data Access: Access to or modification of live production data
- Destructive Testing: Any testing that could cause data loss or system damage
Methodology Alignment
Our RoE framework aligns with industry-standard methodologies and frameworks:
Penetration Testing Execution Standard
Web Security Testing Guide
Open Source Security Testing Methodology
Standard Ethical Hacking Methodologies
Client Responsibilities
- Provide accurate and complete scope information
- Ensure proper backup of critical systems before testing
- Designate technical contacts for coordination
- Notify relevant stakeholders about testing activities
- Provide necessary access credentials for grey/white-box testing
- Review and sign the RoE document before testing begins
Ready to Define Your Rules of Engagement?
Every engagement begins with a scoping call to define your RoE. Book a 30-minute consultation with our team.
Book Scoping Call