Which elements are typically defined in pre-engagement documentation?

• A. Data retention policy
• B. Scope, objectives, and rules of engagement
• C. Hiring policies
• D. Public relations plan

Answer: (B)

Pre-engagement documentation sets the boundaries and expectations for a security assessment. The essential elements defined there are the scope, objectives, and rules of engagement. Scope outlines what will be tested and what is off-limits, establishing clear boundaries so the testers don’t drift into areas not agreed upon. Objectives specify what the engagement aims to demonstrate or uncover—such as identifying critical vulnerabilities, validating remediation, or testing incident response—so everyone agrees on what success looks like. Rules of engagement lay out how testing will be performed: allowed tools, testing windows, escalation paths, contact procedures, safety measures for production systems, data handling requirements, and how findings will be reported. Together, these components prevent scope creep, align risk and expectations, and ensure legal and operational safety from the start. Data retention policy, hiring policies, and public relations plan belong to other areas of governance or operations and do not define how the engagement itself will be conducted.