================================================================================

                       RULES OF ENGAGEMENT
                  Red Team Assessment Agreement

                    MegaCorp Industries, LLC
                   DOCUMENT ID: ROE-MC-2026-0042
                         Version 1.0

================================================================================

1. AUTHORIZATION
================================================================================

This Rules of Engagement document authorizes CyberEdge Security Partners
("the Red Team") to conduct a red team assessment against the systems and
networks owned and operated by MegaCorp Industries, LLC ("the Client").

Authorizing Executive:
  Name:     David Chen, Chief Technology Officer
  Title:    CTO, MegaCorp Industries, LLC
  Date:     2026-03-10
  Signature: [SIGNATURE ON FILE]

Legal Counsel Review:
  Name:     Jennifer Liu, General Counsel
  Firm:     MegaCorp Industries Legal Department
  Date:     2026-03-10
  Signature: [SIGNATURE ON FILE]

Legal Reference:
  - Master Services Agreement #MSA-2026-0188 dated 2026-02-15
  - Statement of Work #SOW-2026-0042 dated 2026-03-01
  - Mutual NDA #NDA-2026-0099 dated 2026-02-01
  - Cyber liability insurance certificate on file (min $5M coverage)


2. ENGAGEMENT OVERVIEW
================================================================================

Engagement Type:    External Black Box Red Team Assessment
Objective:          Simulate an external threat actor attempting to gain
                    access to internal systems and sensitive data
Testing Period:     2026-03-15 through 2026-03-28 (14 calendar days)
Report Due:         2026-04-11 (14 days after engagement end)

Red Team Composition:
  - Team Lead:       1 senior consultant
  - Operators:       2 consultants
  - Analyst:         1 junior consultant
  Total:             4 personnel


3. SCOPE - IN-SCOPE SYSTEMS
================================================================================

The following systems, networks, and domains are authorized for testing:

3.1 Domains:
  - megacorp-industries.com (and all subdomains)

3.2 IP Ranges:
  - 18.220.134.64/26   (AWS us-east-2, development/CI infrastructure)
  - 52.14.88.200/29     (AWS us-east-2, mail/VPN gateway)

3.3 Cloud Resources:
  - AWS Account ID: 1234-5678-9012 (non-production resources only)
  - Any cloud resources discoverable through in-scope systems

3.4 Web Applications:
  - All web applications hosted on in-scope domains and IP ranges
  - REST APIs accessible on in-scope infrastructure
  - Blog (WordPress) at blog.megacorp-industries.com

3.5 Authorized Techniques:
  - OSINT and passive reconnaissance (all public sources)
  - Active network scanning and enumeration
  - Web application testing (OWASP Top 10 + business logic)
  - Social engineering via email (phishing) -- see Section 5 constraints
  - Exploitation of discovered vulnerabilities
  - Post-exploitation, lateral movement, privilege escalation
  - Password attacks (spraying, brute force against in-scope systems)
  - Physical security testing -- NOT AUTHORIZED


4. SCOPE - OUT-OF-SCOPE SYSTEMS
================================================================================

The following are explicitly EXCLUDED from this engagement. Any interaction
with these systems -- even accidental -- must be reported immediately.

4.1 Production Environment:
  [!] The production environment is OUT OF SCOPE.
  - Production web servers (behind Cloudflare, www.megacorp-industries.com)
  - Production API (api.megacorp-industries.com)
  - Production database servers
  - Any system serving live customer traffic

4.2 Third-Party Services:
  - Microsoft 365 / Exchange Online infrastructure (mail.megacorp-industries.com
    is in scope for login testing only -- no attacks against Microsoft infra)
  - Cloudflare infrastructure (CDN/WAF bypass is permitted; attacking
    Cloudflare systems is not)
  - Vercel (careers.megacorp-industries.com hosting)
  - Any third-party SaaS platforms used by the Client

4.3 Prohibited Techniques:
  - Denial of Service (DoS/DDoS) attacks of any kind
  - Data destruction or modification of production data
  - Physical intrusion, lock picking, or facility access
  - Social engineering of C-suite executives (CEO, CFO, COO)
  - Attacks against personal devices or personal email accounts
  - Introduction of actual malware, ransomware, or destructive payloads
  - Any technique that could cause lasting damage to systems or data

4.4 Specific Exclusions:
  - Kevin O'Brien's workstation (192.168.x.x) -- explicitly excluded per
    Client request due to critical ongoing project
  - Backup systems and disaster recovery infrastructure
  - Security monitoring infrastructure (SIEM, IDS/IPS consoles)


5. SOCIAL ENGINEERING CONSTRAINTS
================================================================================

Email-based social engineering (phishing) is authorized with the following
constraints:

5.1 Authorized Targets:
  - Engineering department employees only
  - Maximum of 10 phishing emails per week
  - No targeting of C-suite, HR, Legal, or Finance departments

5.2 Phishing Rules:
  - Phishing emails must not impersonate law enforcement, government
    agencies, or healthcare providers
  - No threats of termination, legal action, or personal harm
  - Landing pages must not collect real credentials -- use token-based
    tracking to confirm clicks/interactions only
  - Any employee who reports the phish to security team must be logged
    (this measures security awareness program effectiveness)

5.3 Prohibited Social Engineering:
  - Vishing (phone-based social engineering)
  - Physical social engineering (tailgating, impersonation)
  - SMS/text-based phishing (smishing)
  - Social media-based attacks against employees


6. TESTING WINDOWS
================================================================================

6.1 Authorized Testing Hours:
  - Passive reconnaissance: Any time (24/7)
  - Active scanning: Monday-Friday, 06:00-22:00 CT
  - Exploitation attempts: Monday-Friday, 08:00-20:00 CT
  - Social engineering emails: Monday-Friday, 09:00-17:00 CT

6.2 Blackout Dates (NO TESTING):
  - 2026-03-22 (Saturday) -- Scheduled infrastructure maintenance
  - 2026-03-23 (Sunday) -- Scheduled infrastructure maintenance

6.3 Extended Hours:
  - Testing outside authorized hours requires written approval from
    the Client POC with minimum 24 hours notice


7. COMMUNICATION PROTOCOLS
================================================================================

7.1 Client Point of Contact (POC):
  Primary:    Priya Patel, Security Engineer
              Email: priya.patel@megacorp-industries.com
              Phone: (512) 555-0142
              Signal: Available (preferred for sensitive comms)

  Secondary:  David Chen, CTO
              Email: david.chen@megacorp-industries.com
              Phone: (512) 555-0100

7.2 Red Team Point of Contact:
  Team Lead:  [Red Team Lead Name]
              Email: [redacted]@cyberedge-security.com
              Phone: (555) 555-0199

7.3 Communication Schedule:
  - Daily status update: Email to Primary POC by 18:00 CT
  - Weekly sync call: Every Wednesday at 14:00 CT
  - Final debrief: Within 5 business days of engagement end

7.4 Emergency Stop ("Kill Switch"):
  If testing causes unintended disruption or is detected and the Client
  wishes to pause:
  - Primary POC calls Red Team Lead with code phrase: "HOLD STATION"
  - All active testing ceases within 15 minutes of receiving code phrase
  - Testing resumes only with explicit written authorization from POC
  - Emergency stop does not terminate the engagement; it pauses testing

7.5 Critical Finding Notification:
  If the Red Team discovers a vulnerability that poses immediate risk
  to the Client (e.g., active compromise by a real threat actor, critical
  data exposure), the Red Team must notify the Primary POC within 1 hour
  of discovery, regardless of time of day.


8. DATA HANDLING
================================================================================

8.1 Data Classification:
  - All engagement data is classified as CONFIDENTIAL
  - Evidence files stored on encrypted drives (AES-256 minimum)
  - No engagement data stored on personal devices or cloud storage

8.2 Credential Handling:
  - Harvested credentials must be stored in encrypted password manager
  - Credentials must not be tested against out-of-scope systems
  - All harvested credentials reported to Client in final report
  - Client responsible for forcing password resets post-engagement

8.3 Sensitive Data:
  - If PII, financial data, or other regulated data is encountered,
    document the access path but do NOT exfiltrate the actual data
  - Take screenshots showing data categories visible (redact PII)
  - Report data exposure findings as critical severity

8.4 Data Retention:
  - Engagement data retained for 90 days after report delivery
  - Client may request early destruction with written notice
  - Destruction confirmed via signed certificate of destruction


9. REPORTING REQUIREMENTS
================================================================================

9.1 Deliverables:
  - Executive summary (2 pages maximum)
  - Technical report with full attack narrative
  - Finding detail sheets with CVSS scores and remediation guidance
  - ATT&CK technique mapping matrix
  - Evidence package (screenshots, logs, tool output)
  - Remediation verification retest (included, within 30 days)

9.2 Severity Ratings:
  Use CVSS v3.1 for individual findings. Overall risk rating uses:
  - Critical: Immediate risk of significant data breach or system compromise
  - High: Exploitable vulnerability with significant impact
  - Medium: Vulnerability requiring specific conditions to exploit
  - Low: Minor issue with limited impact
  - Informational: Best practice recommendation

9.3 Report Distribution:
  - Draft report to Primary POC only for factual review
  - Final report to Primary POC and Secondary POC
  - Client controls further distribution
  - Red Team retains no copies after data retention period


10. LEGAL PROVISIONS
================================================================================

10.1 Liability:
  - Red Team carries professional liability insurance ($5M minimum)
  - Red Team liable for damages caused by actions outside authorized scope
  - Client holds Red Team harmless for impacts from authorized testing

10.2 Law Enforcement:
  - If Client's security team or a third party contacts law enforcement
    regarding Red Team activity, Client POC will immediately intervene
    to confirm authorized testing
  - Red Team operators carry copies of this ROE and authorization letter
    during engagement

10.3 Confidentiality:
  - Red Team will not disclose engagement details, findings, or Client
    identity without written consent
  - Red Team may reference engagement in anonymized case studies only
    with Client written approval


================================================================================
  SIGNATURES
================================================================================

  Client Authorized Representative:
  Name:      David Chen, CTO
  Date:      2026-03-10
  Signature: ___________________________

  Client Legal Counsel:
  Name:      Jennifer Liu, General Counsel
  Date:      2026-03-10
  Signature: ___________________________

  Red Team Lead:
  Name:      [Red Team Lead]
  Date:      2026-03-10
  Signature: ___________________________

================================================================================
  END OF RULES OF ENGAGEMENT DOCUMENT
  Document ID: ROE-MC-2026-0042 | Version 1.0 | Page 1 of 1
================================================================================