Testing windows and blackout periods - Systems that must not be disrupted (production databases, medical devices, financial processing) - Geographic or jurisdictional restrictions - Rate limiting and bandwidth constraints - Notification requirements (will the blue team know testing is happening?)