Insight
2025-09-16 · 5 min read
What a Rules of Engagement document should include
The RoE is the difference between a professional test and an uncontrolled incident. Here is the checklist we refuse to skip.
Named authorizing party, legal entity, and the systems they control.
In-scope and out-of-scope assets, including third-party SaaS you cannot lawfully authorize.
Test windows, time zones, and a 24/7 emergency contact on both sides.
Allowed techniques: social engineering, physical, denial of service — yes or no, in writing.
Data handling: what we may store, for how long, and how you want it destroyed.
A kill switch. If production wobbles, testing stops on a single call.
If a vendor cannot show you a RoE template before a kickoff call, they are not ready to touch your estate.
Want more
Contact us for a team briefing, or for an authorized review if a site you own looks poisoned with SEO spam. We will not run black hat campaigns.
Related: How to hire an ethical hacker.
Next step
Tell us what you need answered.
A 30-minute scoping call is enough to know whether a pentest, a cloud review, or a retainer is the right buy. We will say if it is not.