Water-utility counsel reviews a planned social-engineering test involving employee pretexting. What legal-control practice is most appropriate first?
Select an answer to reveal the explanation.
Short Explanation
Get it in writing before the fake story hits the phone. Complaints-afterward approval, quiet resident targeting, or hallway nods are how utilities meet lawyers the hard way.
Full Explanation
Water-utility counsel reviewing employee pretexting must require written authorization before any pretexting against employees. Written approval defines scope, targets, methods, data handling, and escalation contacts—protecting testers, employees, and the utility if someone challenges the exercise. Verbal convenience is not a substitute for municipal legal control of SE activity.
Beginning pretext calls immediately and seeking approval only if someone complains inverts legal order and exposes the utility to complaints, grievances, or regulatory scrutiny after harm is alleged. Allowing testers to expand targets to residential customers without paperwork is classic scope creep into a population not covered by employee-testing authorization. Treating verbal hallway permission from one supervisor as permanent citywide ROE fails recordkeeping and overstates one person's authority.
Exam caveat: authorization hygiene is frequently tested. Written ROE/authorization first; then limited pretexting; never expand to residents or other populations without new paperwork.
Operational check: obtain counsel-approved written authorization naming employee populations and methods; brief testers on stop conditions; retain the authorization with the after-action package; refuse any request to start calls before the document is signed.