# What are Rules of Engagement?
> Rules of engagement are the agreed boundaries for a security exercise or test — what may be attacked, when, how, by whom, and what is explicitly off-limits.
- Canonical URL: https://yellowcube.eu/glossary/rules-of-engagement/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu
## Content
Rules of engagement record scope, permitted techniques, blackout windows, data-handling duties, safety controls, escalation and deconfliction contacts, evidence handling, and stop conditions. They protect production, third parties, and the testers themselves, and they form part of the authorization record for the work.
### Key points
- **Testable boundaries:** Name the systems, techniques, time windows, and data classes that are in and out — ambiguity becomes an incident during the test.
- **Accident handling:** Define what happens on unintended impact, discovery of a real compromise, or scope drift, including who can halt the exercise.
- **Important limitation:** Rules constrain the test, not the adversary. Anything excluded from testing stays untested — scope the exclusions deliberately and record the residual risk.
### Related terms
[Penetration testing]() · [Red team]() · [Adversary emulation]() · [Vulnerability assessment]() · [Third-party cyber risk]()
### Sources
[NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) · [PCI SSC, Penetration Testing Guidance](https://www.pcisecuritystandards.org/)
## Attribution and scope
This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.