The information security manager is planning a penetration test of production customer-facing systems by an external firm. What must be in place BEFORE testing begins?
Select an answer to reveal the explanation.
Short Explanation
Without a signed permission slip, a penetration tester and an attacker look exactly the same to the law and to your SOC. Rules of engagement tell you who, what, when and how far. The trap is planning the fix before you even know what's broken.
Full Explanation
Penetration testing deliberately attacks systems, so it must be formally authorized by someone with the authority to permit it, and bounded by rules of engagement agreed with the testers. The rules define the systems and addresses in scope, permitted and prohibited techniques, testing windows, handling of sensitive data encountered, communication and escalation contacts, and conditions under which testing stops. This protects production availability, keeps the activity lawful and allows the organization to distinguish the test from a real attack. A complete remediation plan for expected vulnerabilities cannot sensibly exist before the test has found anything; remediation planning follows the results. Notifying all customers is generally unnecessary and could create concern or disclose information; testing of the organization's own systems under proper authorization does not normally require customer notification, though contractual obligations should be checked. A report template agreed with the board is a presentation detail that can be settled at any time and is not a precondition for testing safely or lawfully. Exam caveat: when systems are hosted by a third party, the provider's permission or published testing policy may also be required. Operational check: confirm that signed authorization and rules of engagement are on file, that the scope matches the asset list and that emergency contacts are verified before the first test begins.