Week 2 — Planning and Rules of Engagement
Learning objectives
- Define a penetration test precisely and distinguish it from a compliance audit.
- Write an actionable Rules of Engagement (RoE), holding up even in a contested legal setting.
- Map the regulatory requirements that may apply (Law 25, GDPR, PCI-DSS).
Why the RoE conditions everything else
A pentest without a written RoE is an illegal intrusion, however good the team's intentions. The RoE is the only document you can present in case of dispute: it protects the client, the team and yourself.
Minimum content of an RoE
| Section | What must be in it |
|---|---|
| Perimeter | IP ranges, subdomains, applications, test accounts, explicit exclusions |
| Allowed techniques | Web, network, social engineering, phishing, physical, DoS |
| Forbidden techniques | e.g. no DoS in production, no manipulation of real data |
| Testing windows | Dates and hours, including for noisy tests |
| Escalation contacts | Name, phone reachable 24/7, emergency path |
| Handling of critical findings | e.g. immediate stop + notification within 2 h |
| Evidence handling | Where to store, encryption, retention duration |
Legal and regulatory frameworks
- Quebec (Law 25) / GDPR: any personal data touched by a pentest must be documented. Plan a processing agreement with the client.
- PCI-DSS: mandates regular penetration testing for payment environments.
- Subcontracting contracts: check that the client has the right to authorize tests on the infrastructure (watch out for third-party SaaS).
Activity — Draft a simulated RoE
- Pick a scenario: e-commerce SMB, hospital, law firm.
- Fill in at least a two-page RoE covering the sections in the table above.
- Have a peer review it: every ambiguity is a future dispute.
Common mistakes to avoid
- A perimeter described verbally, never recorded.
- No procedure for the discovery of a pre-existing intrusion (it happens).
- Testing windows with no margin: a scan that overruns falls outside the contract.