Which concept defines the agreed rules for testing activities, including allowed testing methods and timing?

• A. Rules of Engagement
• B. Scoping
• C. Authorization
• D. Incident Response

Answer: (A)

Rules of Engagement define the agreed rules for conducting a security test, including what methods are allowed and when testing may occur. This document sets the boundaries for the engagement—what’s permitted, what isn’t, how tools can be used, testing windows, contact and escalation procedures, and how findings are reported. It ensures the testing stays legal, ethical, and safe and that the tester’s activities align with the client’s risk tolerance and expectations. Scoping identifies which systems are in scope, Authorization provides formal permission to test, and Incident Response governs what happens if an actual incident is detected during testing.