Rules of Engagement
Identification
| Field | Value |
|---|---|
| Client Organization | |
| SOW Reference | CYN-SOW- |
| Engagement Type | |
| Testing Start Date & Time | |
| Testing End Date & Time | |
| Cynetix Lead Tester | |
| Cynetix Tester IP Addresses | |
| Client Technical POC |
Emergency Contacts & Stop Procedures
| Priority | Contact | Role | Phone (24/7) | |
|---|---|---|---|---|
| 1 — Primary | Cynetix Lead Tester | |||
| 2 — Secondary | Cynetix Project Manager | |||
| 3 — Escalation | Client Technical POC | |||
| 4 — Executive | Client Executive Sponsor |
Emergency Stop Phrase: " " — Upon receipt of this phrase via any channel, testing will stop immediately.
Secure Communication Channel: ☐ Signal ☐ WhatsApp ☐ Email ☐ Phone only
Authorized (In-Scope) Systems
Testing is ONLY permitted against the following assets. Any systems not explicitly listed below are out of scope and shall not be tested.
2.1 Network / IP Ranges
| IP Range / CIDR | Description | Environment | Owner Confirmed |
|---|---|---|---|
| ☐ Prod ☐ Stage | ☐ Yes | ||
| ☐ Prod ☐ Stage | ☐ Yes | ||
| ☐ Prod ☐ Stage | ☐ Yes |
2.2 Web Applications / APIs
| URL / Endpoint | Application Name | Auth Required | Test Type |
|---|---|---|---|
| ☐ Yes ☐ No | ☐ Auth ☐ Unauth ☐ Both | ||
| ☐ Yes ☐ No | ☐ Auth ☐ Unauth ☐ Both | ||
| ☐ Yes ☐ No | ☐ Auth ☐ Unauth ☐ Both |
2.3 Cloud Accounts / Tenants
| Provider | Account / Tenant ID | Services in Scope | Authorization Obtained |
|---|---|---|---|
| ☐ AWS ☐ Azure ☐ GCP ☐ Other | ☐ Yes |
2.4 Mobile Applications
| App Name | Platform | Version | Test Build |
|---|---|---|---|
| ☐ iOS ☐ Android | ☐ Prod ☐ Test IPA/APK provided |
Explicitly Out-of-Scope Systems & Actions
The following are strictly prohibited during this engagement:
3.1 Out-of-Scope Systems
3.2 Prohibited Actions
- ☑ Denial of Service (DoS) or Distributed DoS attacks of any kind;
- ☑ Physical access to Client facilities (unless explicitly authorized in SOW);
- ☑ Testing systems belonging to third parties not listed in Section 2;
- ☑ Exfiltration of real customer PII, PHI, or payment data beyond proof-of-concept (a single sample record is sufficient);
- ☑ Permanent modification or deletion of Client data;
- ☑ Installation of persistent backdoors without documented Client approval;
- ☑ Use of ransomware or any destructive malware;
- ☑ Targeting of employees' personal devices;
- ☑ Social engineering of Client employees outside the authorized scope;
- ☐ Other:
Testing Constraints & Special Conditions
4.1 Permitted Testing Hours
☐ Unrestricted (24/7) — Testing may occur at any time
☐ Business hours only — to local time, Monday–Friday
☐ After-hours only — Testing must occur outside business hours
☐ Custom window:
4.2 Destructive / High-Risk Testing
| Activity | Permitted | Conditions / Notes |
|---|---|---|
| Buffer overflow / memory corruption exploits | ☐ Yes ☐ No | |
| Active exploitation of findings (not just PoC) | ☐ Yes ☐ No | |
| Password spraying / brute force | ☐ Yes ☐ No | Max attempts: |
| Phishing email campaigns | ☐ Yes ☐ No | Target list required in advance |
| Lateral movement post-compromise | ☐ Yes ☐ No | |
| Domain controller / AD attacks | ☐ Yes ☐ No | |
| Ransomware simulation | ☐ Yes ☐ No | Isolated test systems only |
| Physical access testing | ☐ Yes ☐ No | Locations: |
4.3 SOC / SIEM Notification
☐ Blind test — Client's security team will NOT be notified. Test SOC detection capabilities.
☐ Informed test — Client's security team WILL be notified of testing dates/times.
☐ Partial — SOC notified of testing dates but not scope or methods.
If any test activity triggers an incident response, Client's security team should contact Cynetix at the emergency contact numbers in Section 1 before escalating to law enforcement.
4.4 Data Handling During Testing
- Cynetix testers will capture the minimum data necessary to demonstrate vulnerability impact;
- Any real PII or sensitive data accessed will be documented and reported — not retained;
- All testing data (screenshots, logs, notes) stored by Cynetix will be encrypted at rest and in transit;
- Testing data will be retained for 90 days post-engagement and then securely deleted unless otherwise agreed.
Credentials & Access Provided
The following test credentials, VPN access, or API keys are being provided to Cynetix for this engagement. Client is responsible for revoking all access immediately upon engagement completion.
| Type | Username / ID | Access Level | System / Application | Expiry |
|---|---|---|---|---|
| VPN | ||||
| App User | Standard User | |||
| App Admin | Admin | |||
| Cloud IAM Role |
Passwords and secrets shall be transmitted via a separate secure channel (not included in this document).
Client Acknowledgements
By signing this document, Client acknowledges and agrees that:
- ☐ All systems listed in Section 2 are owned by or under the lawful control of Client;
- ☐ All necessary third-party authorizations (cloud providers, ISPs, hosting providers) have been obtained;
- ☐ Client's legal counsel has reviewed and approved this engagement;
- ☐ Testing activities may cause temporary performance degradation on tested systems;
- ☐ Client has notified its cyber insurance carrier of the scheduled engagement;
- ☐ Client understands that no penetration test can guarantee complete security;
- ☐ Client accepts responsibility for obtaining appropriate authorizations from any co-tenants in shared cloud environments.
Authorization Signatures
Both parties must sign before any testing activity commences. This document serves as the binding technical authorization for the engagement.