A company wants a penetration test of its application, which is hosted on a third-party cloud provider's platform. Before any testing begins, what must be established with the provider and the testing team?

Rules of engagement are the documented agreement that authorizes and bounds a penetration test. They define the in-scope systems and addresses, testing windows, permitted and prohibited techniques such as denial of service or social engineering, data handling, communication and escalation contacts, and the written authorization of every party with authority over the targets. When the application runs on a third party's platform, the provider's own policies and permission matter, because testing infrastructure the customer does not own without authorization can breach contracts and computer misuse laws. Designing an unknown-environment test refers to how much information testers receive, not whether the platform owner is informed; withholding the test from the provider removes the authorization that makes the activity lawful. A service-level objective for availability during testing addresses performance expectations but does not grant permission or define scope and techniques. A compliance attestation states that a provider meets a standard for a period; it cannot certify the absence of vulnerabilities and does not authorize testing. Exam caveat: many cloud providers publish their own testing policies, and the rules of engagement must comply with them. Operational check: confirm signed authorization from the application owner and the provider, a written scope list, and an emergency stop contact before testing starts.