PENETRATION TESTING AUTHORIZATION

RULES OF ENGAGEMENT AND AUTHORIZATION AGREEMENT

SECTION 1: PARTIES AND ENGAGEMENT

1.1 Client Information (Authorizing Organization)

1.2 Testing Provider Information

1.3 Engagement Details

SECTION 2: AUTHORIZATION

2.1 Authorization Statement

[CLIENT ORGANIZATION NAME] ("Client") hereby authorizes [TESTING PROVIDER NAME] ("Tester") to conduct penetration testing activities as described in this document against the systems, networks, and applications specified in Section 3 (Scope).

This authorization is granted in accordance with:

☐ The Master Services Agreement dated [DATE]

☐ The Statement of Work dated [DATE]

☐ This Rules of Engagement document

2.2 Scope of Authorization

The Tester is authorized to:

☐ Attempt to identify security vulnerabilities in the systems defined in Section 3

☐ Exploit identified vulnerabilities to the extent permitted in Section 4

☐ Document findings and provide recommendations

☐ Retain evidence necessary for the final report (subject to data handling requirements)

2.3 Authorizing Authority

The undersigned has the authority to authorize penetration testing activities against the systems and networks described in this document.

Authorized Representative:

Name: _______________________________
Title: _______________________________
Signature: _______________________________
Date: _______________________________

SECTION 3: SCOPE DEFINITION

3.1 Testing Type

☐ External Penetration Test - Testing from external network perspective

☐ Internal Penetration Test - Testing from internal network perspective

☐ Web Application Penetration Test - Testing of web applications

☐ Mobile Application Penetration Test - Testing of mobile applications

☐ Wireless Penetration Test - Testing of wireless networks

☐ Social Engineering - Phishing, vishing, physical access attempts

☐ Red Team Engagement - Full-scope adversary simulation

☐ Other: _______________________________

3.2 Testing Methodology

☐ Black Box - No prior knowledge provided to testers

☐ Gray Box - Limited information provided (credentials, documentation)

☐ White Box - Full information access (source code, architecture diagrams)

3.3 In-Scope Systems and Networks

3.3.1 Networks

3.3.2 IP Addresses/Ranges

3.3.3 Domains/URLs

3.3.4 Applications

3.3.5 Cloud Environments (if applicable)

3.4 Explicitly Out-of-Scope

The following systems, networks, and activities are NOT authorized for testing:

3.4.1 Out-of-Scope Systems

3.4.2 Third-Party Systems

☐ Third-party hosted systems are out of scope unless separate authorization is obtained

☐ Cloud provider infrastructure (underlying AWS/Azure/GCP systems) is out of scope

☐ Shared hosting environments affecting other tenants are out of scope

3.4.3 Out-of-Scope Activities

☐ Denial of Service (DoS/DDoS) attacks

☐ Physical security testing (unless specifically authorized below)

☐ Social engineering against individuals (unless specifically authorized below)

☐ Testing outside defined IP ranges/systems

☐ Testing outside defined time windows

☐ Actions that could cause data loss or corruption

☐ Other: _______________________________

SECTION 4: RULES OF ENGAGEMENT

4.1 Testing Windows

4.1.1 Authorized Testing Hours

☐ Testing outside these windows requires prior written approval

☐ 24/7 testing is authorized

4.2 Testing Restrictions

4.2.1 Prohibited Activities

The following activities are NOT authorized under any circumstances:

☐ Denial of Service attacks against production systems

☐ Data destruction or modification of production data

☐ Installation of persistent backdoors

☐ Exfiltration of actual customer/employee personal data

☐ Testing of third-party systems without separate authorization

☐ Physical damage to systems or facilities

☐ Activities that violate applicable laws

☐ Accessing or modifying systems outside defined scope

☐ Distribution of malware to end users

☐ Other: _______________________________

4.2.2 Conditional Activities (Require Approval)

The following activities require explicit approval during the engagement:

4.3 Social Engineering Authorization (if applicable)

☐ Social engineering testing is NOT authorized

☐ Social engineering testing is authorized with the following parameters:

Phishing:

☐ Authorized targets: ☐ All employees ☐ Specific groups: _______

☐ Maximum emails: _______

☐ Pre-approved scenarios: ☐ Yes ☐ No

☐ Credential harvesting: ☐ Yes ☐ No

☐ Payload delivery: ☐ Yes ☐ No

Vishing (Phone):

☐ Authorized

☐ Maximum calls: _______

☐ Pre-approved scripts: ☐ Yes ☐ No

Physical:

☐ Tailgating authorized

☐ Facility access testing authorized

☐ Badge cloning authorized

☐ Lock bypass authorized

4.4 Data Handling Requirements

4.4.1 Sensitive Data

☐ Testers shall NOT access, store, or exfiltrate actual sensitive data (PII, PHI, PCI, etc.)

☐ If sensitive data is encountered, testers shall document the finding without capturing actual data

☐ Screenshots containing sensitive data shall be redacted

4.4.2 Evidence Retention

☐ Evidence shall be encrypted at rest using AES-256 or equivalent

☐ Evidence shall be transmitted only via encrypted channels

☐ Evidence shall be destroyed within [30] days of engagement completion

☐ Client may request immediate destruction of evidence upon engagement completion

4.4.3 Confidentiality

☐ All findings are confidential and shall not be disclosed to third parties

☐ Engagement details shall not be used for marketing without Client approval

SECTION 5: COMMUNICATIONS

5.1 Primary Contacts

Client Contacts

Tester Contacts

5.2 Communication Protocols

5.2.1 Regular Updates

☐ Daily status updates via email

☐ Weekly status calls

☐ Real-time updates via [Slack/Teams/Other]: _______

☐ Other: _______________________________

5.2.2 Critical Finding Notification

Critical findings shall be reported immediately via:

☐ Phone to Primary Technical Contact

☐ Encrypted email to [EMAIL]

☐ Other: _______________________________

Critical Finding Definition:

☐ Remote code execution vulnerabilities

☐ Active compromise indicators

☐ Data breach potential

☐ System instability

☐ Other: _______________________________

5.3 Escalation Procedures

If Testing Causes System Issues:

1. Immediately stop testing activity
2. Contact Primary Technical Contact: [PHONE]
3. If unavailable, contact Secondary Contact: [PHONE]
4. Document the activity and impact
5. Await authorization to resume

Emergency Stop Procedure:

The following phrase shall immediately halt all testing activities:

Emergency Stop Code Word: _______________________________

SECTION 6: TECHNICAL DETAILS

6.1 Tester Source IPs

All testing shall originate from the following IP addresses:

☐ These IPs may be whitelisted for testing purposes

☐ These IPs shall NOT be whitelisted (black box test)

6.2 Credentials Provided (Gray/White Box)

☐ Credentials to be provided via secure channel: _______________________________

6.3 VPN/Remote Access (Internal Testing)

6.4 Testing Tools

The following tools are authorized for use:

☐ Nmap/network scanners

☐ Vulnerability scanners (Nessus, Qualys, etc.)

☐ Web application scanners (Burp Suite, OWASP ZAP, etc.)

☐ Exploitation frameworks (Metasploit, etc.)

☐ Password cracking tools

☐ Social engineering tools

☐ Custom tools (to be disclosed): _______________________________

☐ All tools subject to Client approval

SECTION 7: DELIVERABLES

7.1 Report Requirements

☐ Executive Summary

☐ Methodology description

☐ Detailed findings with evidence

☐ Risk ratings (CVSS or custom)

☐ Remediation recommendations

☐ Prioritized remediation roadmap

☐ Technical appendices

7.2 Report Delivery

7.3 Report Classification

Report classification: ☐ Confidential ☐ Restricted ☐ Other: _______

Distribution limited to: _______________________________

SECTION 8: LEGAL AND LIABILITY

8.1 Liability Limitations

☐ Tester liability is limited as defined in the Master Services Agreement

☐ Client acknowledges inherent risks of penetration testing

☐ Client maintains appropriate backups and recovery capabilities

8.2 Indemnification

[Reference Master Services Agreement or include specific terms]

8.3 Insurance Requirements

☐ Tester maintains professional liability insurance: $_______

☐ Tester maintains cyber liability insurance: $_______

☐ Certificate of Insurance provided: ☐ Yes ☐ No

8.4 Legal Compliance

☐ Tester shall comply with all applicable laws

☐ Tester shall not engage in activities that could violate Computer Fraud and Abuse Act (CFAA) or equivalent laws

☐ This authorization is intended to provide legal protection for authorized testing activities

SECTION 9: SIGNATURES AND AUTHORIZATION

9.1 Client Authorization

I am authorized to grant permission for penetration testing of the systems described in this document. I confirm that the systems are owned by or under the control of [CLIENT ORGANIZATION NAME] and that no third-party authorization is required for testing unless otherwise noted.

Authorized Representative:

Printed Name: _______________________________
Title: _______________________________
Signature: _______________________________
Date: _______________________________

Secondary Authorization (if required):

Printed Name: _______________________________
Title: _______________________________
Signature: _______________________________
Date: _______________________________

9.2 Tester Acknowledgment

[TESTING PROVIDER NAME] acknowledges receipt of this authorization and agrees to conduct testing in accordance with the rules of engagement defined herein.

Tester Representative:

Printed Name: _______________________________
Title: _______________________________
Signature: _______________________________
Date: _______________________________

SECTION 10: APPENDICES

Appendix A: Detailed Network Diagrams

[Attach or reference network diagrams]

Appendix B: Asset Inventory

[Attach detailed asset list if applicable]

Appendix C: Cloud Provider Authorization Requirements

AWS:
☐ AWS Penetration Testing Policy acknowledged
☐ No pre-authorization required for most services

Azure:
☐ Microsoft Penetration Testing Rules of Engagement acknowledged
☐ No pre-authorization required

GCP:
☐ Google Cloud Platform AUP acknowledged
☐ No pre-authorization required

Appendix D: Change Log

DOCUMENT CONTROL

This document authorizes penetration testing activities and should be treated as confidential. Retain this document for the duration of the engagement plus [3] years.