SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-rules-of-engagement

In security testing, what do the rules of engagement (ROE) do?

They set guidelines and limits for the test and give the team authority to perform defined activities.

Start playing free

  1. Set the CVSS scores for findings
  2. Define allowed activities and give the test team authority ✔
  3. Guarantee that no systems will be affected

Why: A penetration test needs written permission and boundaries. The ROE says which systems, methods and times are in scope. Without it, testing could look like an actual attack or break the law.

Huh, didn't know that: In NIST's penetration test model, no actual testing happens during the planning phase.

The dad joke
How does a computer get drunk? It takes screenshots.
Like this card?
Play the game

References

Answer: Define allowed activities and give the test team authority. A penetration test needs written permission and boundaries. The ROE says which systems, methods and times are in scope. Without it, testing could look like an actual attack or break the law.

  1. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
    gives the test team authority to conduct defined activities without the need for additional permissions
    Checked 2026-10-10.
  2. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
    No actual testing occurs in this phase.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?Security & PrivacyA file's hash value no longer matches after someone edits the file. Which CIA property was affected?

That's stuff everyone should know.