Defining the scope (which systems, networks, applications, and physical locations are in bounds) - Establishing rules of engagement (what techniques are permitted, what is off-limits) - Setting the timeline (start date, end date, testing windows) - Defining communication channels (who to contact if