Testing hours and days (e.g., "Monday through Friday, 8 AM to 6 PM EST only") - Blackout periods (e.g., "No testing during end-of-month financial processing, March 28-31") - Permitted testing techniques (scanning, exploitation, social engineering, physical) - Prohibited actions (DoS testing, data de