Glossary: Governance, Risk and Compliance

rules of engagement

A signed document, attached to a pen test's SOW, that says exactly what testers may and may not do: scope, timing, methods, data handling, contacts and stop rules, and who authorized it.