1

Rules of Engagement Worksheet:

Penetration Testing Team Contact Information:

Primary Contact: ____________________________________________

Mobile Phone: ____________________________________________

Pager: ____________________________________________

Secondary Contact: _______________________________________________

Mobile Phone: ________________________________________________

Pager: ________________________________________________

Target Organization Contact Information:

Primary Contact: ____________________________________________

Mobile Phone: ____________________________________________

Pager: ____________________________________________

Secondary Contact: _______________________________________________

Mobile Phone: ________________________________________________

Pager: ________________________________________________

"Daily Debriefing" Frequency: _____________________________________________

"Daily Debriefing" Time/Location: __________________________________________

Start Date of Penetration Test: ______________________________________________

End Date of Penetration Test: ______________________________________________

Testing Occurs at Following Times: __________________________________________

Will test be announced to target personnel: ____________________________________

Will target organization shun IP addresses of attack systems: _____________________

 2

Does target organization's network have automatic shunning capabilities that might disrupt
access in unforeseen ways (i.e. create a denial-of-service condition), and if so, what steps will be
taken to mitigate the risk:

____________________________________________________________________

____________________________________________________________________

Would the shunning of attack systems conclude the test: _______________________

If not, what steps will be taken to continue if systems get shunned and what approval (if any)
will be required:

_______________________________________________________________________

_______________________________________________________________________

_______________________________________________________________________

IP addresses of penetration testing team's attack systems:

_______________________________________________________________________

_______________________________________________________________________

_______________________________________________________________________

Is this a "black box" test: __________________________________________________

What is the policy regarding viewing data (including potentially sensitive/confidential data) on
compromised hosts:

_______________________________________________________________________

_______________________________________________________________________

_______________________________________________________________________

Will target personnel observe the testing team: _________________________________

 3

______________________________________________________________
Signature of Primary Contact representing Target Organization

____________________________
Date

______________________________________________________________
Signature of Head of Penetration Testing Team

____________________________
Date

If necessary, signatures of individual testers:

______________________________________________________________
Signature

____________________________
Date

______________________________________________________________
Signature

____________________________
Date

______________________________________________________________
Signature

____________________________
Date

______________________________________________________________
Signature

____________________________
Date