Engagement Management
Engagement management
Engagement management covers everything before the first packet and everything that constrains it afterwards: authorization, scoping, legal and compliance obligations, communication and closeout. The exam tests whether you can distinguish 'the client asked us to' from 'we are legally permitted to', and turn a business request into a defensible test plan.
The authorization stack
Each document answers a different question:
- NDA - confidentiality of findings; signed before detailed scoping.
- MSA - the standing contract: liability, indemnity, terms.
- SOW - this engagement: targets, deliverables, dates, fees, test type (black/grey/white box), and whether retesting is included.
- ROE - operational detail: testing window, allowed and forbidden techniques, allowlisted source IPs, stop procedure, escalation contacts.
- Authorization letter - names tester, client, scope and dates; carried and produced on demand.
Scope, constraints, compliance
Scope is defined by assets (CIDR ranges, hostnames, APIs, SSIDs, physical sites), time (windows, blackouts, time zones), and exclusions. Third-party hosted assets - payment processors, SaaS, cloud tenants you do not own - require that party's own written permission; a client cannot authorize them on someone else's behalf. Compliance shapes handling: PCI DSS segmentation validation and cardholder data care, HIPAA and GDPR limits on viewing or storing data, and law (CFAA in the US, Computer Misuse Act in the UK) defining what is criminal without authorization.
Communication
Agree a primary contact, escalation path, secure channel and a critical-finding notification window, for example notify within two hours of a confirmed remote code execution. Deconflict with the SOC so your traffic is not hunted as a real intrusion.
Worked example
A client asks you to test the web shop 'including checkout'. Checkout posts to a third-party payment gateway. Confirm in the SOW which endpoints are in scope; obtain the gateway provider's written authorization before testing that integration; use only accounts you create; never enter real card data; stop and report rather than exfiltrate if you hit live customer PII. Authorization derives from asset ownership plus written permission, not from the client's intent.
Traps
Verbal approval is not authorization. Testing an adjacent IP because it appeared in a scan is out of scope. Retaining real customer data as proof breaches data-handling terms. Missing a blackout because it was quoted in another time zone is a classic trap. Treating scope as advisory once you find something interesting ends engagements.