When defining the communication path for a PenTest engagement, what should the IT manager establish?

• A. A testing threshold.
• B. A strict no-escalation policy.
• C. A random contact protocol.
• D. An exclusive external contact channel.

Answer: (A)

Setting clear communication triggers during a PenTest is essential to balance progress with safety. A testing threshold defines, in advance, what levels of activity, risk, or impact require notifying the IT manager and stakeholders, pausing certain tests, or escalating to senior leadership. This keeps the engagement within agreed risk tolerance, ensures proper authorization at each stage, and makes reporting predictable—you know when and how to escalate, what constitutes a critical finding, and who should be contacted given the severity. Without thresholds, communication can become ad hoc, which increases risk of either missing important issues or causing unnecessary disruption. A strict no-escalation policy would block timely responses to dangerous findings; a random contact protocol would be chaotic; an exclusive external channel would hinder internal coordination. Establishing a testing threshold is the right approach.