📖 What is Rules of Engagement (ROE)?
Rules of Engagement (ROE) is a formal document that defines the constraints and boundaries of a penetration test. It specifies the approved timeframes, authorized IP addresses, prohibited techniques, and communication channels to ensure the test is conducted safely and legally.
"Pay close attention to the difference between the SOW (Scope of Work) and the ROE; the ROE focuses specifically on the 'how' and 'when' of the actual execution."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Rules of Engagement (ROE)?
- ▸ Authorized Targets: A detailed list of approved IP addresses, domains, and hostnames to prevent accidental attacks on third-party systems or out-of-scope assets.
- ▸ Prohibited Techniques: Explicit restrictions on high-risk activities, such as Denial of Service (DoS) attacks or social engineering, to ensure business continuity during testing.
- ▸ Communication Plan: Established channels and designated points of contact for reporting critical findings immediately and notifying the client before starting specific phases.
- ▸ Timeline and Scheduling: Defined windows of time when testing is permitted, often scheduled during off-peak hours to minimize the impact on production users.
- ▸ Emergency Stop Procedures: A pre-arranged method for the client to immediately halt all testing activities if a critical system failure or security incident occurs.
🎯 How does Rules of Engagement (ROE) appear on the PT0-002 Exam?
You may be asked to identify the correct document when a scenario describes a tester needing to know the specific hours they are allowed to scan a network.
A scenario might describe a situation where a tester is prohibited from using a specific exploit; you will likely need to identify the ROE as the governing document.
Expect questions that require you to distinguish between the SOW, which defines the project's goals, and the ROE, which defines the tactical execution constraints.
❓ Frequently Asked Questions
What is the primary difference between the SOW and the ROE?
The Scope of Work (SOW) is a high-level agreement focusing on deliverables, pricing, and overall goals. The ROE is a tactical document focusing on the 'how' and 'when' of the actual execution.
What happens if a tester deviates from the ROE during an engagement?
Deviating from the ROE can lead to legal liability, breach of contract, or accidental downtime. Any necessary changes must be formally documented and signed by the client first.