What a Rules of Engagement document should include

Named authorizing party, legal entity, and the systems they control.

In-scope and out-of-scope assets, including third-party SaaS you cannot lawfully authorize.

Test windows, time zones, and a 24/7 emergency contact on both sides.

Allowed techniques: social engineering, physical, denial of service — yes or no, in writing.

Data handling: what we may store, for how long, and how you want it destroyed.

A kill switch. If production wobbles, testing stops on a single call.

If a vendor cannot show you a RoE template before a kickoff call, they are not ready to touch your estate.