A red-team engagement without documented pre-engagement deliverables creates legal risk, operational disruption, and findings you cannot remediate. When a simulated attacker moves through your environment without clear boundaries, communication protocols, and escalation thresholds agreed in writing, the exercise becomes a source of confusion rather than assurance. This red team engagement checklist itemises the nine artefacts and three approval gates that must be signed off before the simulation starts, particularly for institutions subject to SAMA Cyber Security Framework Domain 8 requirements on security testing and adversary simulation.
The Saudi Central Bank's SAMA Cyber Security Framework requires regulated financial institutions to conduct periodic security assessments that include adversary simulation. Domain 8 mandates testing of detection and response capabilities against realistic attack scenarios. A red-team engagement meets this requirement—but only if it is scoped, documented, and controlled in a way that produces actionable findings without creating unintended business impact or legal ambiguity.
This article provides a practical checklist you can use the same day you begin planning a red-team engagement. Each deliverable is explained in one line on why it matters, grouped by purpose, and followed by the three approval gates that lock scope and prevent mid-engagement surprises.
The Nine Pre-Engagement Deliverables
Group One: Scope and Boundaries
1. Rules of Engagement Document
A written agreement that defines what the red team may and may not do, the hours during which activity is permitted, the techniques that are in scope (social engineering, physical access, denial-of-service testing), and the legal protections extended to the engagement team. This document protects both parties and establishes the legal basis for simulated hostile activity on your network.
2. Target-Asset Inventory
A list of systems, applications, network segments, and facilities that are in scope for the engagement, including IP ranges, domain names, and physical locations. Without this inventory, the red team cannot plan an objective-based attack chain, and you risk activity spilling into out-of-scope environments.
3. Exclusion List
A list of systems, data stores, third-party connections, and business processes that must not be touched under any circumstances—production payment switches, core banking platforms during month-end processing, shared infrastructure with partners, legacy systems without rollback capability. This list prevents operational disruption and third-party liability.
Group Two: Communication and Escalation
4. Communication Protocol
The names, roles, mobile numbers, and secure communication channels (Signal, encrypted email, dedicated Slack channel) for the engagement team and the internal coordination team, available twenty-four hours during the engagement window. This protocol ensures that questions, clarifications, and unexpected findings reach the right person immediately.
5. Incident-Escalation Thresholds
Pre-agreed criteria that define when the red team must pause and notify the coordination team before proceeding—discovery of a live external attacker, accidental access to customer personal data, triggering of a business-continuity failover, or any event that could result in regulatory notification. These thresholds prevent the simulation from becoming a real incident.
6. Safe-Word Procedure
A single unambiguous code word or phrase that either party can use to halt the engagement immediately, no questions asked, with a defined restart process. This procedure is the emergency brake when something goes wrong or when business circumstances change mid-engagement.
Group Three: Evidence and Accountability
7. Evidence-Handling Agreement
A written commitment on how the red team will collect, store, transport, and destroy evidence of compromise—screenshots, credential hashes, exfiltrated test data, packet captures—including encryption standards, retention periods, and deletion certification. This agreement protects sensitive information discovered during the engagement and satisfies data-protection obligations.
8. Insurance-Notification Waiver
A signed acknowledgment from your legal or risk function that the engagement has been disclosed to your cyber-insurance carrier if your policy requires notification of authorised penetration testing, or a documented decision that notification is not required. This waiver prevents a coverage dispute if a real incident occurs during the engagement window.
9. Post-Engagement Debrief Schedule
A calendar commitment for the joint replay session (often called a purple-team debrief) where the red team walks your defenders through the attack chain step by step, and a deadline for the written report. This schedule ensures that findings are reviewed while they are fresh and that remediation planning begins immediately.
The Three Approval Gates That Lock Scope
Even with all nine deliverables prepared, a red-team engagement should not begin until three internal approval gates have been passed. These gates prevent scope creep, mid-engagement disputes, and findings that cannot be acted upon.
Gate One: Legal and Compliance Approval
Your legal counsel or chief compliance officer reviews the rules of engagement, confirms that the engagement does not violate any contractual obligations with third parties (cloud providers, payment networks, outsourcing partners), and signs off on the insurance-notification waiver. This gate protects the institution from liability and ensures that the engagement does not trigger unintended regulatory reporting.
Gate Two: Operational Approval
Your head of operations, IT service management, or change advisory board confirms that the engagement window does not overlap with planned changes, major releases, peak transaction periods, or regulatory reporting deadlines, and that the exclusion list is complete. This gate prevents the simulation from disrupting business-critical processes or being blamed for unrelated outages.
Gate Three: Executive-Sponsor Approval
Your CISO, CRO, or the executive accountable for Domain 8 compliance reviews the objectives of the engagement, confirms that the scope aligns with board-mandated testing requirements, and authorises the budget and resource commitment. This gate ensures that the engagement produces findings the organisation is prepared to remediate and that the results will be presented to the board or risk committee as evidence of control effectiveness.
All three gates must be documented in writing—email confirmation is sufficient—and attached to the rules of engagement before the red team begins reconnaissance.
Why These Deliverables Matter for SAMA CSF Domain 8
SAMA Cyber Security Framework Domain 8 requires financial institutions to test the effectiveness of their security controls through periodic assessments that simulate real-world attack scenarios. A red-team engagement is one of the most rigorous forms of this testing, but it is also one of the most disruptive if not properly scoped.
The nine pre-engagement deliverables and three approval gates serve three purposes. First, they create a legal and operational safe container for simulated hostile activity. Second, they ensure that the engagement tests the controls and scenarios that matter most to your risk profile and regulatory obligations. Third, they produce findings that are specific, actionable, and tied to your actual detection and response capabilities rather than theoretical vulnerabilities.
Institutions that skip or rush pre-engagement documentation typically encounter one of three problems: the red team discovers a critical issue but cannot proceed because it crosses an undocumented boundary; the engagement is paused mid-stream because operations were not informed; or the final report contains findings that cannot be remediated because they involve third-party systems or contractual constraints that were not identified in advance.
How Red Teaming Works in Practice
A structured red-team engagement follows four phases, each building on the pre-engagement deliverables.
During the planning phase, objectives are defined, scope and rules of engagement are documented, and the nine deliverables are prepared and approved through the three gates. During the reconnaissance phase, the red team gathers intelligence on the attack surface using only the methods agreed in the rules of engagement. During the execution phase, the red team conducts a controlled attack toward the agreed objectives, pausing at escalation thresholds and respecting the exclusion list. During the replay phase, the red team and your defenders review the attack chain together in a joint session, and a written report is delivered.
The deliverables from a red-team engagement include an executive summary for the board, a technical attack narrative, a detection and response gap analysis, and an improvement roadmap. The engagement is threat-informed, follows an objective-based attack chain, operates under strict rules of engagement, and concludes with a purple-team replay with defenders. The typical duration is four to eight weeks.
How We Deliver Red-Team Engagements
We simulate a determined attacker pursuing agreed objectives—from initial access to impact—to test your people, processes, and technology end to end, designed to test detection and response against a realistic, objective-driven attack.
Our process follows four phases: plan (objectives, scope, and rules of engagement), recon (intelligence gathering on the attack surface), execute (controlled attack toward objectives), and replay (joint review with defenders and report). We deliver an executive summary for the board, a technical attack narrative, a detection and response gap analysis, and an improvement roadmap. Our engagements use threat-informed scenarios, follow an objective-based attack chain, include social engineering as an optional component, operate under strict rules of engagement, and conclude with a purple-team replay with defenders. A typical engagement runs four to eight weeks and is designed to meet SAMA Cyber Security Framework requirements.
If you are preparing for a red-team engagement under SAMA CSF Domain 8 or a board-mandated adversary simulation, this checklist gives you the structure to begin planning today. The nine deliverables and three approval gates are not bureaucratic overhead—they are the control framework that makes the engagement safe, legal, and useful.
