What is 'safe harbor' in the context of a penetration test?

• A. The agreed-upon authorization, scope, and boundaries that protect both tester and client legally.
• B. A type of legal shield that prevents any liability.
• C. An internal policy requiring testers to share vulnerabilities publicly.
• D. The agreed-upon authorization, scope, and boundaries that protect both tester and client legally.

Answer: (D)

Safe harbor in a penetration test refers to the pre-approved authorization, scope, and boundaries that protect both tester and client legally. This framework, often captured in a rules of engagement or engagement letter, spells out what systems can be tested, what methods are allowed, the testing window, data handling, and how findings will be reported. When testing stays within these agreed limits, actions are considered authorized, reducing legal risk for the tester and clarifying expectations for the client. It’s not a blanket shield that eliminates all liability, and it doesn’t authorize public disclosure or actions outside the defined scope. It provides a controlled, lawful environment for the assessment so vulnerabilities can be identified and reported responsibly.