thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Rules of Engagement (RoE)

The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.

Definition

Rules of engagement translate the contract scope into operational instructions for testers. They typically cover testing windows, in-scope and excluded IP ranges, permitted and prohibited techniques (such as denial of service or social engineering), data handling, emergency stop procedures and escalation contacts. Testers must stop and escalate if they hit anything outside the RoE.

Example

An RoE that allows testing only between 22:00 and 04:00 UTC, prohibits DoS, and lists the client's on-call SOC lead for emergencies.

Exam tip

PenTest+ tests whether you know which document governs day-to-day test conduct (RoE) versus the business/legal terms (MSA, SOW).

Related terms