Rules of engagement record scope, permitted techniques, blackout windows, data-handling duties, safety controls, escalation and deconfliction contacts, evidence handling, and stop conditions. They protect production, third parties, and the testers themselves, and they form part of the authorization record for the work.
Key points
Testable boundariesName the systems, techniques, time windows, and data classes that are in and out — ambiguity becomes an incident during the test.
Accident handlingDefine what happens on unintended impact, discovery of a real compromise, or scope drift, including who can halt the exercise.
Important limitationRules constrain the test, not the adversary. Anything excluded from testing stays untested — scope the exclusions deliberately and record the residual risk.