A water utility will hire a third party to penetration-test the customer portal and selected OT jump hosts. What must be defined before testing begins?
Select an answer to reveal the explanation.
Short Explanation
Rules of engagement are the playbook and the fence line—what's in bounds, when the whistle blows, and who to call if a pipe metaphorically bursts. No RoE means no green light for the testers.
Full Explanation
Rules of engagement (RoE) formally authorize third-party testing by defining in-scope assets, prohibited actions, testing windows, communication paths, and escalation contacts. Clear RoE protects both the utility and testers and is a core third-party assessment control before penetration testing against IT or OT-related targets.