Rules of Engagement Worksheet:
Penetration Testing Team Contact Information:
Primary Contact: ____________________________________________
Mobile Phone: ____________________________________________
Pager: ____________________________________________
Secondary Contact: _______________________________________________
Mobile Phone: ________________________________________________
Pager: ________________________________________________
Target Organization Contact Information:
"Daily Debriefing" Frequency: _____________________________________________
"Daily Debriefing" Time/Location: __________________________________________
Start Date of Penetration Test: ______________________________________________
End Date of Penetration Test: ______________________________________________
Testing Occurs at Following Times: __________________________________________
Will test be announced to target personnel: ____________________________________
Will target organization shun IP addresses of attack systems: _____________________
Does target organization's network have automatic shunning capabilities that might disrupt access in unforeseen ways (i.e. create a denial-of-service condition), and if so, what steps will be taken to mitigate the risk:
____________________________________________________________________
Would the shunning of attack systems conclude the test: _______________________
If not, what steps will be taken to continue if systems get shunned and what approval (if any) will be required:
_______________________________________________________________________
IP addresses of penetration testing team's attack systems:
Is this a "black box" test: __________________________________________________
What is the policy regarding viewing data (including potentially sensitive/confidential data) on compromised hosts:
Will target personnel observe the testing team: _________________________________
______________________________________________________________
Signature of Primary Contact representing Target Organization
____________________________
Date
Signature of Head of Penetration Testing Team
If necessary, signatures of individual testers:
Signature
art.w