Engagement Management · Topic 1 of 5
Planning and Scoping an Engagement
Learn how a penetration test is scoped: contracts, rules of engagement, testing windows, target selection and the methodology frameworks the exam names.
- 5 min
- Includes a diagram
- The MSA is the umbrella contract, the SOW describes one project, and the NDA covers confidentiality.
- The ROE defines allowed actions, testing windows, contacts and stop conditions.
- Written authorization from someone who actually owns the assets is required before testing.
What it is
Planning and scoping is the work done before any scan is run. The tester and the client agree what will be tested, how, when and under which limits.
A penetration test (pen test) is an authorised, time-boxed attempt to find and prove weaknesses. Without written agreement on scope, the same activity is an attack, so this phase protects both sides.
How it works
Scoping starts with the client's goal: meet a compliance requirement, check a new application, or measure how well defenders detect an intrusion. The goal drives the test type, the budget and the depth.
The documents
Several documents are usually involved, and the exam expects you to tell them apart.
| Document | Purpose |
|---|---|
| Master service agreement (MSA) | Sets the general legal and commercial terms between two companies for many projects |
| Statement of work (SOW) | Describes one project: deliverables, timeline, fees and acceptance |
| Non-disclosure agreement (NDA) | Protects confidential information that the tester sees |
| Rules of engagement (ROE) | Sets the technical and behavioural limits during the test |
| Authorization letter | Proves the tester may test the named systems |
Rules of engagement
The ROE is the operating manual for the test. It normally covers the testing window (dates and hours), permitted and forbidden techniques, and how data will be handled.
It also lists emergency contacts and the conditions that stop the test. For example, the client may forbid denial of service (DoS) tests or social engineering against executives. Anything not allowed in writing should be treated as forbidden.
Scope and target selection
Scope lists the in-scope assets, such as Internet Protocol (IP) ranges, domains, applications, cloud accounts, wireless networks and buildings. It should also name what is out of scope, such as production databases or a third party's systems.
Target selection means choosing which of those assets to test and in which order. Risky or fragile systems, for example medical devices or industrial controllers, may need extra care or a separate window.
Assets hosted by someone else, such as a cloud provider, a managed service or a software as a service (SaaS) tool, need permission from that owner as well. Check the provider's current testing policy before any activity.
How much the tester knows
| Approach | Tester knowledge | Typical use |
|---|---|---|
| Unknown environment (black box) | Little or no prior information | Simulates an outside attacker |
| Partially known (grey box) | Some details, such as a user account | Balances realism and efficiency |
| Known environment (white box) | Full documentation and source code | Deepest coverage in the least time |
Frameworks and standards
Frameworks give the work a repeatable structure. The exam names several.
| Framework | What it provides |
|---|---|
| Penetration Testing Execution Standard (PTES) | Phases of a test from pre-engagement to reporting |
| Open Source Security Testing Methodology Manual (OSSTMM) | A scientific method for measuring operational security |
| NIST SP 800-115 | US government guide to technical security testing |
| MITRE ATT&CK | A knowledge base of attacker tactics and techniques |
| Open Worldwide Application Security Project (OWASP) Top 10 | The most common web application risks |
| Common Vulnerability Scoring System (CVSS) | A standard way to rate severity |
When a scenario says the tester found a new, interesting host that was not listed, the safe answer is to stop and ask for a written scope change, not to test it.
More frameworks and standards
| Framework | What it provides |
|---|---|
| Council of Registered Ethical Security Testers (CREST) | An accreditation body whose member testers follow defined testing standards |
| OWASP Mobile Application Security Verification Standard (MASVS) | A baseline of security requirements for mobile applications |
| Purdue model | A layered reference architecture for industrial control and operational technology networks, with levels 0 to 5 and a demilitarised zone (DMZ) between information technology and operational technology, used for segmentation and scoping |
Threat modeling frameworks
Threat modeling structures thinking about what could go wrong. The exam names three models.
| Model | Idea |
|---|---|
| STRIDE | Threat categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege |
| DREAD | A scoring model rating damage potential, reproducibility, exploitability, affected users and discoverability |
| OCTAVE | Operationally Critical Threat, Asset, and Vulnerability Evaluation, an asset-centred, risk-based organisational method |
A STRIDE example: forging a login token is spoofing, while altering a stored record is tampering.
What to remember for the exam
- The MSA is the umbrella contract, the SOW describes one project, and the NDA covers confidentiality.
- The ROE defines allowed actions, testing windows, contacts and stop conditions.
- Written authorization from someone who actually owns the assets is required before testing.
- Scope must name in-scope and out-of-scope assets, including third-party and cloud systems.
- Unknown, partially known and known environments map to black, grey and white box testing.
- Scope creep (extra work added informally) needs a formal change to the SOW or ROE.
- Compliance-driven tests follow the standard's rules, while goal-based tests follow the client's objective.
- PTES, OSSTMM and NIST SP 800-115 are methodologies, while MITRE ATT&CK describes attacker behaviour and CVSS rates severity.
Common mistakes
Confusing the ROE with the SOW. The SOW covers commercial terms such as price and deliverables. The ROE covers how the technical work is allowed to happen.
Assuming a client can approve anything. A company can authorise testing only of assets it owns or controls. A shared hosting provider or a partner network needs its own permission.
Treating scope as fixed forever. Findings during the test can justify a change, but the change must be agreed and recorded before work continues.
Ignoring the testing window. A scan allowed only overnight must not run at midday, even if it would finish faster.
Mixing up the frameworks. MITRE ATT&CK is not a testing methodology, and CVSS does not describe test phases.
Check yourself
Which document sets the technical limits and the testing window for a test?
The rules of engagement (ROE).
A tester finds an unlisted server that looks vulnerable. What should happen next?
Stop and request a written scope change before testing it.
Which approach gives the tester full documentation and source code?
Known environment testing, also called white box.
Topic 1 of 5 in Engagement Management
Test yourself on Engagement Management
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.