Rules of engagement
Rules of engagement are the agreed instructions and constraints that define which security-testing activities are authorized and how the testing must be conducted.
Set the boundaries before testing
Rules of engagement spell out what a testing team may do and where it must stop. NIST defines them as guidelines and constraints established before security testing. Its template covers matters such as scope, schedule, contacts, permitted and prohibited activity, incident handling, and data handling.
A request to assess help-desk verification leaves important choices open. Which support teams and accounts are in scope? May the tester request an account change, or only observe whether the agent proposes one? Who can stop the exercise? Answer these questions before the first interaction.
Define what counts as going too far
A help-desk assessment can stop at the decision to approve a change, or it can include carrying out that change on a designated test account. Those are different permissions. Specify whether password resets, authenticator enrollment, and remote software execution are allowed, rather than leaving the tester to infer them from “test account recovery.”
If the agreement permits only observing the approval decision, an offer to reset the account is the stopping point. Record what was offered; do not report it as completed account access. Any expansion needs the authorized owner’s approval before testing continues.
Make the agreement usable
Write instructions that testers and their contact can use during a call or incident, without having to guess what the agreement means. Define the emergency contact route, pause conditions, evidence recipients, and retention or deletion instructions.
Before testing, work through an ambiguous case together. Resolve any disagreement about what is allowed, and keep the agreed rules with the assessment.