The CISO for an organization has called penetration testers that she met at an information security conference a few months ago. The penetration testers come to the office for a meeting and describe the process of how the test would proceed. The testers explain that before they can get started, they need written authorization from the company. Which of the following would outline the authorization, scope, and timing necessary for the penetration testers to begin?
A) NDA
B) Risk matrix
C) SLA
D) Rules for engagement

Question

Quizplus · Accepted Answer

The Rules of Engagement (RoE) document outlines the authorization, scope, and timing for penetration testers to begin their work, ensuring that all activities are agreed upon and legally authorized.

The CISO for an Organization Has Called Penetration Testers That