Question

A security manager has hired an external firm to conduct a black-box penetration test of the company's internet-facing applications. Before the testers begin any activity, the manager wants to ensure the engagement is legally defensible and that testers do not inadvertently disrupt production systems or exceed their authorized boundaries. Which document is MOST important to finalize and sign before testing begins?

Accepted Answer

The rules of engagement defining scope, authorized targets, timing, and permitted techniques

Answer

The final penetration test report template to standardize deliverables

Answer

The vulnerability scan results from the most recent internal assessment

Answer

The service-level agreement covering application uptime guarantees