Rules of Engagement
What is Rules of Engagement?
Documented guidelines that define the scope, methods, timing, and constraints for authorized security testing activities.
Frameworks that govern rules of engagement
What the standards actually require on rules of engagement
Requirements naming rules of engagement across 6 standards, quoted from the control text.
Where the test includes reconnaissance or open-source intelligence gathering, the organisation ensures it stays within the agreed scope and rules of engagement: the effort is set to an agreed depth appropriate to the time and goals, additional domains, busines...
ptes::PTES-3.1 · Keep intelligence gathering within scope and the rules of engagement →Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CA-8(2) · Penetration Testing | Red Team Exercises (CA-8(2)) →Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CA-8(2) · Penetration Testing | Red Team Exercises (CA-8(2)) →The SAP, developed by the 3PAO and signed by both the 3PAO and the provider as agreement to the scope, methodology, test plan and rules of engagement, uses the FedRAMP template with Appendix A the security controls selection worksheet, B the sampling methodolo...
fedramp-rev-5::P.6 · P.6 Security assessment plan →The FI should perform adversarial attack simulation (red team) exercises that emulate real attackers' tactics, techniques and procedures against the people, processes and technology behind critical business functions, to test its cyber defence and response pla...
monetary-authority-of-singapore-technology-risk-management-guidelines::13.4 · 13.4 Adversarial Attack Simulation Exercise →Apply NIST SP 800-115 Technical Guide to Information Security Testing and Assessment published September 2008 + still operative for security testing methodology + complement to NIST SP 800-53A + NIST SP 800-30.
NISTSP115-1 · Scope, Methodology, and Assessment Planning →Questions people ask about rules of engagement
What is Rules of Engagement?
Why is Rules of Engagement important for compliance?
Which compliance frameworks address Rules of Engagement?
Where can I learn more about Rules of Engagement?
See how Rules of Engagement applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.