A water SOC reviews proposed social-engineering activities. Which distinction correctly keeps practice inside authorized civic scope?
Select an answer to reveal the explanation.
Short Explanation
Testing your own staff under a signed charter is not the same sport as cold-calling ratepayers with fake stories. Keep SE drills inside the employee ROE—residents are not your training dummies.
Full Explanation
Authorized civic social-engineering practice is scoped to ROE-covered employees, contractors, and systems under written authorization—not to the general public or ratepayers as training props. Employee-only SE tests under charter differ in law and ethics from criminal pretexting against residents. Water SOC reviews must keep that boundary explicit so purple-team language never becomes a euphemism for unauthorized public deception.
Equating random resident pretext calls with authorized employee drills fails by concept: consent, employment relationship, and legal authority are not interchangeable. Allowing any public-facing pretext because it improves internal click-rate dashboards substitutes vanity metrics for legality. Labeling criminal pretexting against ratepayers as a purple-team exercise is a category error that can create criminal and civil exposure for the agency and testers.
Exam caveat: Some jurisdictions run carefully governed public education campaigns; those are not the same as covert SE against residents during a pentest. If external parties appear in scope at all, counsel, privacy, and explicit authorization must define boundaries—default remains employee/systems under ROE. Do not confuse OSINT on public information with interactive pretexting of citizens.
Operational check: Read the ROE target list and confirm residents and public call targets are excluded unless separately authorized in writing. In the activity proposal, require a one-line scope statement distinguishing employee-only authorized SE from any public interaction, and reject proposals that blur those categories to chase metrics.