A county CIO asks what a letter of engagement is supposed to lock in before any scanning starts. What should the tester treat as the primary purpose of that letter?
Select an answer to reveal the explanation.
Short Explanation
Think of the letter of engagement like a building permit before you swing a hammer. It is not about which tool you like — it is the signed go-ahead that says what you may touch, when, and how hard. Without that written authorization, scope, and RoE, scanning is just unauthorized noise.
Full Explanation
A letter of engagement documents client authorization and the contractual bounds of testing before active techniques begin. It typically captures scope (assets and exclusions), rules of engagement (timing, contacts, prohibited actions), and related legal cover. Tool selection and remediation are separate concerns; exploitation of every finding is never implied. Professional CPTS-style work starts only after those written constraints are clear.