# Statement of Engagement Authorization Document (SEAD)

---

## Engagement Details

| Field | Value |
|-------|-------|
| **Reference** | [ENGAGEMENT_REF] |
| **Client** | [CLIENT_NAME] |
| **Tester** | [OPERATOR_NAME] |
| **Organization** | [TESTER_ORG] |
| **Engagement Type** | [blackbox / greybox / whitebox] |
| **Methodology** | [PTES / NIST / OWASP / TIBER / CBEST] |
| **Start Date** | [YYYY-MM-DD] |
| **End Date** | [YYYY-MM-DD] |
| **Testing Window** | [Start time — End time, timezone] |

---

## Authorization Statement

This document authorizes [OPERATOR_NAME] from [TESTER_ORG] to conduct security testing activities as described in this document against the systems owned by [CLIENT_NAME]. This authorization is valid from [START_DATE] to [END_DATE].

**All testing activities are authorized and conducted with explicit permission.**

---

## In-Scope Targets

| Target | Type | Priority | Notes |
|--------|------|----------|-------|
| [domain.com] | Web Application | P1 | Primary target |
| [10.0.0.0/24] | Internal Network | P2 | Post-initial-access |
| [app.domain.com] | Mobile Backend API | P1 | |

---

## Out-of-Scope

The following MUST NOT be tested:
- [List excluded targets]
- Production databases (read-only access only)
- Third-party payment processors

---

## Rules of Engagement

| Activity | Permitted |
|----------|-----------|
| Automated vulnerability scanning | ✅ Yes |
| Manual exploitation | ✅ Yes |
| Password brute force | ✅ Yes (test accounts) |
| DoS / DDoS simulation | ⚠️ With 24-hour notice |
| Social engineering (phishing) | ✅ Yes |
| Social engineering (vishing) | ✅ Yes |
| Physical security testing | ✅ Yes |
| Data exfiltration (PoC) | ✅ Minimum viable sample only |
| Persistent C2 implants | ✅ Document and remove after |
| Destructive actions | ❌ Never |

---

## Emergency Contacts

| Role | Name | Phone | Email |
|------|------|-------|-------|
| CISO | | | |
| VP Engineering | | | |
| IT Emergency | | | |
| Legal | | | |

**Stop testing immediately if:** [List critical scenarios]

---

## Data Handling

- All discovered credentials: Document reference only, do not store in plain text
- PII discovered: Minimum viable sample, destroy after engagement
- Evidence retention: [X] days after final report delivery
- Report classification: STRICTLY CONFIDENTIAL — RESTRICTED DISTRIBUTION

---

**Authorized by:** ___________________  
**Title:** ___________________  
**Date:** ___________________
