As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the a

A Service Level Agreement defines performance metrics and uptime expectations between a service provider and a client, and has no role in governing the legal framework or permitted actions of a security test.

Project Scope outlines the boundaries of work to be performed but does not address associated violations, liability protections, or the legal authorization required for offensive security testing.

Rules of Engagement (RoE) is a legally binding document used in penetration testing engagements that defines exactly what systems may be targeted, which techniques are authorized, the testing timeline, and the consequences for violations. It explicitly protects the organization's assets and infrastructure while also shielding the tester from criminal liability by documenting written authorization.

A Non-Disclosure Agreement governs the confidentiality of information exchanged between parties but does not define testing specifics, permitted attack methods, or the liability protections required during an engagement.