Rules of engagement (scope and mandate)
RoE · scope · scope of work · mandate · written mandate · authorisation letter · authorization letter · statement of work
A signed document setting out what a tester is allowed to do: target systems, dates, permitted and forbidden techniques, emergency contacts and what to do if something unexpected happens.
In practice
Rules of engagement turn an attack into a lawful service. They are signed by someone with authority to bind the system owner; a hosting provider or SaaS vendor must also agree for its own infrastructure. Anything outside the scope remains an intrusion under Article 323-1 of the French Criminal Code. The document also states what is excluded (for example denial of service or social engineering), the testing hours and the procedure if a critical flaw or traces of a real attack are found.
The French “Bluetouff” case (Court of Cassation, criminal division, 20 May 2015, No. 14-81.336) shows that technically open access is not authorisation: a user who downloaded documents reachable without a password on a public health agency’s extranet was convicted, notably of fraudulently remaining in a system, because he carried on after realising the area was protected.
