Engagement Management
Engagement Management
Engagement management covers everything that happens before the first packet and after the last one: scoping, authorization, contracts, compliance obligations, resource planning, communication, and reporting. Questions here test judgment as much as recall, so learn the artifacts and what each one controls.
The statement of work (SOW) and master service agreement (MSA) set commercial terms; the rules of engagement (ROE) define what may be tested, when, how, and what is explicitly off-limits. The authorization letter (sometimes called a "get out of jail free" letter) names the signer, the target ranges, the testing window, and an emergency contact, and should be carried during testing. Scope includes in-scope IPs, domains, applications, physical locations, and - for social engineering - people, plus exclusions such as production databases or partner-hosted systems.
Regulatory and contractual constraints appear constantly in scenarios: PCI DSS for cardholder data, HIPAA, GDPR and other privacy laws, and the client's own policies. Understand data handling (encryption of evidence, retention, destruction), NDA obligations, and liability/insurance. Know the communication plan too: escalation triggers for critical findings, deconfliction so the client's blue team does not treat you as an incident, and status reporting cadence.
Traps: a technical contact verbally expanding scope is not authorization; cloud or SaaS assets hosted by a third party usually require the provider's written permission; contracts expire; "the whole company" does not include subsidiaries or acquisitions unless listed. Scope creep, testing outside the approved window, and failing to document client-supplied credentials all invalidate results.
Rule of thumb: if a target is not written in the scope document, stop and get written approval from the authorized signer - never proceed on a verbal OK.
Reporting closes the loop: executive summary, methodology, findings with evidence and risk ratings, and prioritized remediation.