Rules of Engagement · Northgray

01

Authorization

Every engagement needs an Authorization Letter. It must be signed by someone with documented authority over the people, premises and systems in scope.
Before any testing, we check that authority: corporate records, the signer's role, and a call-back to a number we find ourselves.
A landlord, property manager or building security team must give written consent when testing passes through space or controls they run, such as a tower lobby and its turnstiles, shared elevators and corridors, or a mall's common areas. In those buildings, the building itself is part of what is being tested. It isn't needed when the client's site has its own entrance from public space and testing stays inside the client's premises, such as a strip-mall storefront.
Some systems are run by someone else, such as an IT provider or a cloud or software provider. We need their written approval, or a published testing policy that covers the work.
Authorization covers only the dates, hours, locations, systems and groups named in the schedule. Any change must be made in writing and signed before it is tested.
If we can't confirm authority, we decline the engagement or that part of it.

02

What every scope schedule records

Each engagement adds a signed scope schedule. Where the schedule is stricter than these rules, the schedule applies. Where it is looser, these rules apply, unless the schedule names the exception and both sides sign it.

Services

Which of vishing, phishing, physical access, black box and swarm are in scope.

Window

Start and end dates, testing hours and time zone.

In scope

Named sites, floors, departments, phone lines, email domains, IP ranges and applications.

Out of scope

Anything excluded beyond the standing exclusions in section 3.

Trusted agents

The small group who know about the campaign, normally 2 to 4 people.

Emergency contacts

At least two people, reachable 24/7 for the whole window.

Stop signal

The word or phrase either side uses to pause all activity at once.

Approved pretexts

The scenario themes the client has signed off on. That includes any professional roles (such as an outside lawyer, an auditor or an inspector), any of the client's real vendors or service providers operators may name (such as its IT provider), and any real people operators may name or voice-clone, each with their own signed consent.

Recording

Whether test calls are recorded.

Evidence

What may be photographed or logged, and who receives it.

Reporting

Who gets the report and debrief, and when.

03

Always out of scope

Private homes, and any property not named in the schedule.
Daycares, prayer rooms, washrooms, health clinics and first-aid rooms.
Personal devices, personal email, personal phone numbers and personal social media accounts. We never contact staff through them.
Life-safety systems: fire alarms, sprinklers, fire doors, emergency exits and power controls.
Third-party systems and services that the client doesn't control, unless their owner has approved the work in writing.
Anyone under 18.

04

What we never do

Damage property, force entry, pick locks or climb structures.
Disable, prop open or tamper with alarms, fire doors or any safety equipment.
Disrupt service, for example by denial-of-service testing or by locking staff out of their accounts on purpose.
Install malware or run destructive code.
Open, copy or remove documents, files or customer data.
Keep real passwords, MFA codes or session tokens.
Let a payment, transfer or banking change go through.
Pose as police or any other peace officer, emergency services, the military, or a tax, customs or immigration official.
Use a professional role the client hasn't approved in the scope schedule. When posing as a lawyer, auditor or inspector, we never use the name of a real firm or a real professional, and never show fake badges, uniforms, ID or licence numbers.
Pose as a real, named person unless the scope schedule lists them and they have signed their consent. That includes using their name, voice or likeness, or an AI clone of their voice (see section 5).
Use threats, personal or family emergencies, job loss, legal threats or any other distressing scenario.
Ask anyone to bypass a safety control in a way that could put anyone at risk.
Carry weapons or anything that could be mistaken for one.
Resist, mislead or run from police or security staff.

05

AI voice cloning

AI voice cloning is a standard option in our vishing work. A cloned voice can be used for help desk calls, payment requests, or a call that sets up a physical visit. Three conditions apply:

The person whose voice is cloned is listed in the scope schedule and signs their consent. This is normally the executive being imitated.
The clone is used only during the testing window, and only on the people and scenarios in scope.
When the campaign ends, we delete the voice model and the recordings used to build it, and confirm that in writing.

We never clone the voice of anyone outside the client organization, such as a real vendor, a bank employee or a public official.

06

Benign proof

We stop at the moment a test succeeds. When someone agrees to an action, the operator ends the interaction before the action happens. Proof is a timestamp, a log entry, a photo of a marker, or harmless technical evidence.

Markers are removed, or listed for the client to remove, when the campaign ends. If we see sensitive information by accident, we don't copy it, and we tell the trusted agents.

07

Stopping and safety

All activity pauses at once if:

either side uses the stop signal;
there is a medical emergency, a safety risk, or a risk of property damage;
a staff member seems distressed;
police are called or arrive;
an operator finds they are outside the scope;
we find signs of a real attack or incident by someone else.

Testing resumes only when the sponsor approves it in writing.

Operators carry the signed Authorization Letter, government ID and the emergency contacts at all times. If they are challenged, they stop and show the letter, then ask the person to call the client's emergency contact. They follow every direction from police and security staff.

08

Communication

We confirm the emergency contacts work before the campaign starts.
Trusted agents get a short status update at the end of each testing day.
We report within 24 hours any critical exposure that shouldn't wait for the final report.
We report signs of a real attack or incident immediately.
We deliver the final report and debrief within five business days of the campaign's end.

09

Evidence and confidentiality

We handle evidence as described in our Privacy Policy. Whether calls are recorded is agreed in the signed scope schedule. Even when it is agreed, we don't record calls to people in places where the law requires every party's consent. Operators keep written notes of those calls instead.

Photos avoid people, and any face or name caught by accident is blurred or removed. Only the engagement team and the named trusted agents can access evidence. Everything about the engagement stays confidential to the client and Northgray.

10

People, not blame

Reports describe failed processes and controls, never individuals. They don't name or rank staff, and they make no disciplinary recommendations. The client agrees not to use the results to discipline anyone. Instead, we recommend a no-blame follow-up with the teams involved.

11

The client's part

Confirm authority truthfully, and get any third-party approvals the scope needs.
Confirm that testing is consistent with its workplace policies, any notices it owes staff (including any notice needed before calls are recorded), and any collective agreement.
Keep the list of trusted agents small, and tell no one else.
Keep the emergency contacts reachable for the whole window.
Tell us before the window starts about anything that changes the risk, such as layoffs, a recent real incident, construction, new tenants or system changes.

12

Our operators

Operators follow these rules, and the law wherever they work. Any breach of these rules is reported to the client and investigated.

13

Changes to these rules

The version and date are at the top. An engagement follows the version attached to its signed agreement.