Which of the following should be done FIRST when planning to conduct internal and external penetration testing for a client?

Establishing the timing of testing is important, but it cannot be definitively set until the scope and methodology are defined within the rules of engagement.

Identifying milestones is part of project planning, which follows after the foundational parameters and scope are established by the rules of engagement.

Determining the test reporting structure is a crucial aspect of communication, but it is a subsequent step after the parameters and objectives of the test are outlined in the rules of engagement.

Establishing the rules of engagement (RoE) is critical as the first step because it legally and operationally defines the scope of the test, authorized targets, permitted attack techniques, communication channels, emergency contacts, legal disclaimers, and data handling procedures. Without clear RoE, unauthorized activities, legal liabilities, or unintended system disruptions could occur.