Once you have determined the type of assessment and the level of knowledge testers will have about the target, the rest of the rules of engagement (RoE) can be written. Key elements include the following: - **The timeline** for the engagement and when testing can be conducted. Some assessments will intentionally be scheduled for noncritical timeframes to minimise the impact of potential service outages, whereas others may be scheduled during normal business hours to help test the organisation's reaction to attacks. - **What locations, systems, applications, or other potential targets are included or excluded**. This also often includes discussions about third-party service providers that may be impacted by the test, such as Internet services providers, software-as-a-service(SaaS) or other cloud service providers, or outsourced security monitoring services. Any special technical constraints should also be discussed in the RoE. - **Data handling requirements** for information gathered during the penetration test. This is particularly important when engagements cover sensitive organisational data or systems. Requirements for handling *often include confidentiality requirements* for the findings, such as encrypting data during and after the test, and contractual requirements for disposing of the penetration test data and results after the engagement is over. - **What behaviours to expect from the target.** Defensive behaviours like *shunning, blacklisting, or other active defences* may limit the value of a penetration test. If the test is meant to evaluate defences, this may be useful. If the test is meant to test a complete infrastructure, shunning or blocking the penetration testing team's efforts can waste time and resources. - **What resources are committed to the test**. In known and partially known testing scenarios, time commitments from the administrators, developers, and other experts on the targets of the test are not only useful, they can be necessary for an effective test. - **Legal concerns should also be addressed**, including a review of the laws that cover the target organization, any remote locations, and any service providers who will be in scope. - **When and how communications will occur**. Should the engagement include daily or weekly updates regardless of progress, or will the penetration testers simply report when they are done with their work? How should the testers respond if they discover evidence of a current compromise?