# Scoping & Rules of Engagement

> Master the most critical phase of any pentest. Learn how to define scope, draft rules of engagement, and secure legal authorization before testing begins.

Canonical: https://codelivly.com/rooms/scoping-rules-of-engagement
Last updated: 2026-08-30

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 280 |

The difference between a professional penetration test and a criminal act is paperwork. This module teaches you how to properly scope an engagement, define clear boundaries, and establish ironclad Rules of Engagement (RoE) that protect both the tester and the client. You will learn how to conduct scoping interviews, identify third-party dependencies, define testing windows and intensity limits, and draft authorization letters that hold up under scrutiny. By the end, you will be able to structure the Pre-Engagement phase of any assessment with the rigor required by enterprise clients and regulatory frameworks.

## Lessons

1. What is Scoping & Why It Protects Both Parties (30 min)
2. Defining Scope: In Scope vs Out of Scope Assets (30 min)
3. Rules of Engagement Document Walkthrough (30 min)
4. Legal Considerations (30 min)
5. Black Box vs Grey Box vs White Box Testing (30 min)

## Related

- [Learning path: Pentest Methodology & Reporting](https://codelivly.com/learning-paths/pentest-methodology-reporting)
- [All rooms](https://codelivly.com/rooms)