A water utility will hire a third party to penetration-test the customer portal and selected OT jump hosts. What must be defined before testing begins?
Select an answer to reveal the explanation.
Short Explanation
Rules of engagement are the playbook and the fence line—what's in bounds, when the whistle blows, and who to call if a pipe metaphorically bursts. No RoE means no green light for the testers.
Full Explanation
Rules of engagement formally authorize third-party penetration testing by defining in-scope assets, prohibited actions, approved methods, testing windows, communication paths, and escalation contacts. Before a water utility allows testing of the customer portal and selected OT jump hosts, written RoE protects both the utility and the testers: it grants legal authorization within boundaries and prevents accidental impact to unsafe or out-of-scope industrial systems. Without RoE, testing lacks a clear green light and fence line. Only a social media announcement with no scope limits publicizes activity without authorizing or constraining it. Announcements are not engagement rules and invite uncontrolled testing assumptions. An unlimited authorization to attack any city system at any time is dangerously overbroad, especially near OT environments. RoE must bound scope, timing, and methods rather than grant unrestricted attack rights. A verbal okay from one technician with no written boundaries is inadequate authorization. Personnel change, memories differ, and OT-adjacent testing requires documented scope and escalation paths for safety and accountability. Exam caveat: Penetration tests require defined rules of engagement covering scope, timing, methods, and contacts. Verbal nods, social posts, or unlimited authorizations fail that requirement. Operational check: Approve written RoE naming the customer portal and approved OT jump hosts, exclude unsafe OT targets, set test windows and emergency contacts, and verify the testing firm will not proceed until RoE is signed.