Rules of Engagement
A written agreement that sets the boundaries for a penetration test, red team exercise, or other security assessment, covering which systems are in scope, which techniques are allowed, testing windows, and who to contact if something breaks. On federal cybersecurity contracts, the government and contractor typically sign the ROE before any testing begins, and staying inside it protects the contractor from liability for authorized activity.
Related terms
Administrative Contracting Officer
ACOAn Administrative Contracting Officer manages a contract after award, handling modifications, cost and schedule oversight, and day-to-day compliance monitoring, while a separate procuring contracting officer typically handles the award itself. An ACO's authority is defined by a written letter of delegation and is limited to the specific functions it grants.
Communications Security
COMSECCommunications Security covers the measures, equipment, and procedures used to protect government voice, data, and message traffic from interception, exploitation, or unauthorized disclosure, including encryption, key management, and transmission security. Contractors working with classified or sensitive communications equipment must follow NSA/CNSS COMSEC policy, often including trained custodians and controlled key material.
Contract Security Classification Specification
DD Form 254The DoD form that conveys the security requirements for a classified contract, including the highest classification level involved, the facility clearance the contractor needs, and whether the work requires access to categories like COMSEC, SCI, or CUI. The government issues a DD Form 254 to the prime, and the prime issues its own DD Form 254 to any subcontractor that needs classified access, so it sets the security baseline for everyone performing on the contract.
Contracting Officer
KOThe Contracting Officer is the government official with legal authority to enter into, administer, modify, or terminate a contract on the agency's behalf. Only the KO can bind the government to contractual commitments; direction from any other government employee, including a program manager or COR, does not carry that authority.
Contracting Officer's Representative
CORA Contracting Officer's Representative is appointed in writing by the KO to monitor day-to-day contract performance, inspect deliverables, and serve as the technical point of contact with the contractor. A COR has no authority to change price, scope, or terms; performance concerns get escalated back to the Contracting Officer for a binding decision.
