Picture a red team operator on the first morning of a new job. A scope document has just landed in the inbox from Northbridge Health Finance, a mid-size fintech with 900 employees. It names the client, the systems to be tested, the rules of engagement, and the legal authority behind the work. A red team operation is an authorized, simulated attack on an organization, carried out to show how well its people, processes, and defenses hold up. Nothing starts until this document is read, understood, and signed.
Four parts of the document matter most. Legal authority is the written permission from someone who can grant it. Scope lists what may and may not be tested. The rules of engagement (ROE) set limits on how testing is done. Deliverables describe the evidence the client expects back. Here is a made-up excerpt for this engagement, and the widget lets you examine each part in context. Let’s look at how those four parts appear in a real intake:
Written permission firstWithout signed authorization from the system owner, the same activity is unauthorized access, not a test.
Boundaries protect the client, and they protect the tester too. A vague scope is the most common way a well-meaning engagement goes wrong. Consider how a single unclear line could ripple through Northbridge Health Finance, from a quiet misunderstanding to legal and trust damage. Here is the chain of events, step by step: