Engagement Management · Topic 2 of 5
Legal and Ethical Compliance
Understand authorization letters, mandatory reporting, privacy and compliance regulations, and the ethical duties that govern every penetration test.
- 5 min
- Written authorization from an asset owner is the first requirement for any test.
- Third-party systems need the third party's permission, even if the client asks for them to be tested.
- Evidence of a current compromise or illegal content triggers immediate notification, not a wait until the final report.
What it is
A penetration tester deliberately does things that would be crimes without permission. Legal and ethical compliance is what turns that activity into a lawful, professional service.
It has three parts: written authorization, obedience to laws and regulations, and ethical conduct such as honesty and confidentiality. The exam tests whether you can pick the lawful and ethical action in a scenario.
How it works
Authorization
The authorization letter (sometimes called a permission to test letter) names the tester, the systems, the dates and the person who approves. It should be signed by someone with real authority over the assets, not just a helpful employee.
Testers often carry a copy during physical or on-site work. If security staff or police stop them, the letter and a contact number are the proof that the activity is approved.
Laws that matter
Laws differ by country, and the exam stays at a general level. You should recognise the following names and what they cover.
| Law or standard | Area |
|---|---|
| Computer Fraud and Abuse Act (CFAA) | United States law against unauthorised access to computers |
| Computer Misuse Act | United Kingdom law against unauthorised access |
| General Data Protection Regulation (GDPR) | European Union privacy law for personal data |
| Health Insurance Portability and Accountability Act (HIPAA) | United States rules for health information |
| Payment Card Industry Data Security Standard (PCI DSS) | Industry standard for card data, including regular penetration testing |
| Sarbanes-Oxley Act (SOX) | United States rules on financial reporting controls |
PCI DSS is a contractual industry standard, not a government law. Many other rules, such as export controls on security tools, may also apply when a team works across borders.
Privacy and data handling
Testers may see personal data, health records or card numbers. The rules of engagement (ROE) should say how little data to collect, how to store it, and when to destroy it.
A good rule is to prove access without taking real data. A screenshot showing that a file could be read is usually enough, and copying thousands of records is not.
Mandatory reporting
Some findings cannot wait for the final report. The tester must tell the client at once, using the agreed escalation path, in these cases.
- Evidence that a real attacker is already inside the network (an indicator of compromise).
- A critical flaw that exposes systems or data right now.
- Evidence of illegal activity, which may also need to be reported to law enforcement as the law and contract require.
- An accidental outage or data exposure caused by the test.
For illegal material, the usual guidance is to stop, avoid copying or opening more of it, and notify the designated contact and legal counsel.
Ethical conduct
Ethics in this field is about trust. The tester keeps client information confidential, stays inside the scope, and reports findings honestly, including the tester's own mistakes.
Responsible disclosure also matters. If a tester finds a flaw in a vendor's product during a job, the vendor and the client are informed through agreed channels, not through a public post.
Never keep client data longer than the contract allows, and never send test evidence through personal email or unapproved cloud storage.
Risk to the tester
A penetration test carries risk for the tester as well as the client, and the engagement documents should address it.
- Legal liability if the scope or authorization is wrong, so written approval must match what is tested.
- Physical safety during on-site work, which the rules of engagement and a safety contact should cover.
- Insurance and indemnification clauses in the contract that set who is liable if something breaks.
- The chance of hitting a third party's systems by mistake, which careful scope and target checks reduce.
What to remember for the exam
- Written authorization from an asset owner is the first requirement for any test.
- Third-party systems need the third party's permission, even if the client asks for them to be tested.
- Evidence of a current compromise or illegal content triggers immediate notification, not a wait until the final report.
- PCI DSS, HIPAA, GDPR and SOX are the regulations most likely to appear in scenarios.
- Collect the minimum data needed to prove a finding, and protect and later destroy it as agreed.
- The CFAA (United States) and Computer Misuse Act (United Kingdom) criminalise unauthorised access.
- Confidentiality continues after the engagement ends.
- Regulations can set test frequency and depth, so a compliance test must follow the standard's rules.
Common mistakes
Believing the final report is the only place to report. Critical issues and signs of a live attacker go to the client immediately.
Assuming a signed contract covers cloud providers. Cloud and hosting companies publish their own testing rules, and a client contract cannot override them.
Treating compliance as the same as security. Passing a PCI DSS test shows that required checks were done, not that the environment is safe.
Copying real data as proof. Large data copies create a new breach risk and may break privacy law.
Forgetting that laws vary by place. Testing from one country against systems in another can involve both countries' laws, so counsel should review it.
Check yourself
Who should sign the authorization letter?
A person with real authority over the assets being tested, such as the asset owner or a delegated executive.
What should a tester do on finding evidence of an active attacker?
Notify the client through the agreed escalation path at once, then agree whether to pause or continue.
Is PCI DSS a law?
No, it is an industry standard that card brands and acquirers require contractually.
Topic 2 of 5 in Engagement Management
Test yourself on Engagement Management
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.