Loading…
Home / Templates / Rules of engagement
Rules of engagement template for penetration testing
The authorization letter says whether testing is allowed. The rules of engagement document says how it will be run — what is permitted, how the team communicates, how the test stops, and how evidence is handled. Here is what each clause needs to cover, and the full template to copy.
What the ROE has to cover
Permitted testing categories
List explicitly what is permitted — network, web application, API, authentication — and mark anything intrusive, such as denial-of-service or social engineering, as a separate opt-in. Blanket permission is how tests cause outages.
Rate limits and restrictions
Set automated scan rates and any hard limits (for example, no destructive payloads, no modification of production data) so the test cannot degrade a live service.
Communication channels
Name the channel and cadence for status updates, and the primary and backup contacts on both sides for the duration of the test.
Escalation path
Say what happens if a critical finding, or a real incident, is discovered — who is told, how fast, and whether testing pauses.
Emergency stop
Define the exact phrase that halts the test, who may issue it, and how quickly the tester must confirm and stop. This should be impossible to misinterpret.
Evidence and data handling
Agree how evidence is captured and stored, who can see it, how long it is kept and how it is destroyed, and how confidential material encountered by chance is handled.
Retest terms
State whether a retest is included, its window and cost, and which findings are eligible — so remediation has a defined verification step.
The template
RULES OF ENGAGEMENT (ROE)
Engagement: ______________________________
Tester: ______________________________
Client: ______________________________
Authorization letter reference: ______________________
1. OBJECTIVE
Scope of work: ______________________________
In-scope assets, window and source IPs: see the signed authorization letter.
2. PERMITTED TESTING CATEGORIES
Authorized by default:
[ ] Network / infrastructure scanning
[ ] Web application testing
[ ] API testing
[ ] Authentication / authorization testing
Require separate written approval:
[ ] Intrusive testing (e.g. denial of service) [ ] Social engineering
Explicitly prohibited:
______________________________________________
3. RATE LIMITS AND RESTRICTIONS
Maximum automated request rate: ______________
Prohibited actions (e.g. data modification, destructive payloads): ________
Production data may be: read / modified only with prior approval
4. COMMUNICATION
Status updates every ________ via ______________________
Primary channel: ______________________
Client primary contact: __________ Backup: __________
Tester primary contact: __________ Backup: __________
5. ESCALATION
If a critical finding or real incident is discovered:
Notify ______________________ within ________ minutes.
Testing will: continue / pause until cleared.
6. EMERGENCY STOP
The Client may halt testing at any time by stating "STOP" to the Tester's
primary contact. The Tester will acknowledge immediately and cease all active
testing within ________ minutes. No new testing resumes without written
clearance from the Client.
7. EVIDENCE AND DATA HANDLING
Evidence captured: ______________________
Stored where / accessible to whom: ______________________
Retention period: ______________ Destruction method: ______________
Confidential material encountered by chance will be: reported / not retained
8. REPORTING
Draft delivered by: ______________ Final by: ______________
Format: ______________________
9. RETEST
Retest included: yes / no Window: ______________
Eligible findings: confirmed high and critical, unless otherwise agreed.
10. APPROVAL
Client signer: ____________________ Date: __________
Tester lead: ____________________ Date: __________Plain text on purpose, so you can paste it into your own document workflow and adapt it to your engagement.
How to use it
- 1.Issue the ROE at the same time as the authorization letter, and cross-reference the two documents by date so it is always clear which scope they refer to.
- 2.Make the prohibited list explicit. "Everything except destruction of data" invites argument; a named list of prohibited actions does not.
- 3.Have both sides test the emergency stop phrase once before testing starts, so nobody is learning it live during an incident.
- 4.Store the signed ROE with the authorization letter and the final report, so the whole engagement is one traceable record.
Rules of engagement FAQ
- What is the difference between a rules of engagement document and an authorization letter?
- The authorization letter is the permission: it records who authorized what, for which assets and window. The rules of engagement document is the plan: how the permitted testing will be conducted, communicated, escalated, stopped and evidenced. Most engagements need both.
- Should intrusive testing be included in the ROE by default?
- No. Intrusive techniques such as denial-of-service, destructive payloads and social engineering should be a separate, explicit opt-in with their own controls, because they carry a real risk of service impact that a standard scan does not.
- Why does the emergency stop clause matter so much?
- It is the one clause that protects the client's availability in the middle of a test. If testing causes an unexpected incident, a single unambiguous phrase that both sides have practised is the difference between a prompt halt and an argument while a service is down.
- How long should test evidence be retained?
- Long enough to support the findings, remediation and any later dispute — but no longer than the client's policy requires. State the retention period and destruction method in the ROE rather than leaving it to default behaviour.
Related template
Use this ROE alongside the penetration test authorization letter, which records the permission this document assumes.
PentSeal enforces these clauses rather than filing them
The ROE above is a document the tester is trusted to follow. PentSeal makes the same scope and window a hard gate on execution: it verifies target ownership, records the signed scope and testing window, and will not run a scan outside them. Walk the workflow in the browser, or talk to us about a pilot on a domain you own.