Rules of Engagement & Operational Standards

← [RETURN_TO_MAIN_TERMINAL]

This document governs the operational, legal, and authorization frameworks applied to all security assessments, penetration tests, vulnerability audits, and red team engagements conducted by NodePenTest (a division of Divitiae Terrae LLC). These standards ensure maximum security testing rigor while protecting client system integrity, business operations, and legal boundaries.

1. The 6-Step Professional Engagement Process

PHASE 01: Scope Definition & Legal Authorization

Prior to initiating any technical activity, a formal Permission to Test / Authorization Agreement and Rules of Engagement (RoE) contract must be executed by an authorized executive of the client organization. Specific IP ranges, domains, cloud accounts, and explicit exclusions are formally documented.

PHASE 02: Target Verification & Jump Host Identification

NodePenTest provides the client's Security Operations Center (SOC) with our static IPv4 testing IPs, custom User-Agent strings, and tester credentials. We perform target ownership verification to confirm that third-party shared hosting or prohibited sub-tenants are isolated from the test boundary.

PHASE 03: Passive & Active Reconnaissance

Our engineers perform non-intrusive threat surface mapping, sub-domain discovery, exposure checks, and tech stack fingerprinting without sending disruptive payloads. Perimeter assets are verified against cloud asset registers.

PHASE 04: Controlled Exploitation & Vulnerability Analysis

Engagements transition to active manual exploitation focusing on high-impact vulnerabilities (OWASP Top 10, Auth Bypasses, Privilege Escalation, API Logic Flaws). All automated finding candidates are manually verified by hand to eliminate false positives.

PHASE 05: Immediate High-Risk Notification (24-Hour Alert)

If a Critical (CVSS 9.0+) or high-risk Remote Code Execution (RCE) / Unauthenticated Data Exposure vulnerability is uncovered, testing on that vector is temporarily paused, and the client's designated technical lead is notified within 24 hours with an immediate mitigation workaround.

PHASE 06: Reporting, Retesting & Attestation

We deliver an Executive Summary (for C-Suite/Board review) and a Detailed Technical Remediation Guide (for engineering teams). Every standard engagement includes 1 Free Retest within 30 Days to verify patch effectiveness before issuing a formal Security Attestation Letter.

2. Legal Safe Harbor & Compliance Protections

When tests are conducted under a fully signed RoE with Divitiae Terrae LLC:

Authorization Status: Activities executed strictly within defined scope boundaries constitute authorized access under the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030) and international equivalent frameworks.
Third-Party Cloud Providers: Tests involving AWS, Azure, GCP, or hosted platforms are conducted in compliance with vendor penetration testing notification policies. Clients maintain responsibility for obtaining permissions for third-party hosted software where vendor consent is required.
GDPR / POPIA Confidentiality: Any personal or customer data encountered incidentally during testing is handled under strict confidentiality, encrypted in transit and at rest, and never exfiltrated outside the client's tenant boundary.

[EMERGENCY_ABORT_PROTOCOL]

In the event that testing activities cause unintended service disruption, trigger critical system destabilization, or if a real-world unauthenticated breach is discovered in progress, NodePenTest engineers will immediately halt active testing, log system states, and activate emergency escalation procedures via direct phone/emergency hotline.

3. Record Keeping & Evidence Preservation

To ensure auditability, transparency, and legal protection:

Comprehensive Testing Logs: Full raw terminal logs, request/response traffic captures (Burp Suite state logs), and timestamped execution histories are recorded during testing.
Evidence Retention Window: All assessment data, screenshots, terminal output, and client vulnerability logs are encrypted using AES-256 and retained for 90 days post-engagement to assist client engineering remediation.
Cryptographic Data Destruction: After the 90-day window (or upon written client request), all client evidence files on NodePenTest infrastructure are permanently purged using secure cryptographic wiping algorithms.

4. Prohibited Testing Actions

Unless explicitly authorized in writing in the client's custom RoE schedule, NodePenTest strictly prohibits:

Volumetric Denial of Service (DoS / DDoS) attacks against network links or servers.
Physical entry attempts into client facilities or data centers.
Unsanctioned destructive data alteration or permanent deletion of production database records.
Social engineering or spear-phishing targeting non-designated company employees.

5. Execution & Inquiries

For questions regarding our operational procedures or to execute a custom Rules of Engagement agreement for your upcoming security audit, contact our engineering leads:

Divitiae Terrae LLC ( NB : We are not d/b/a = NodePenTest
Attn: Operations & Security Engineering Dept.
1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, USA
Email: roe(at) nodepentest.com | Web: www.nodepentest.com

Rules of Engagement (RoE) & Legal Framework