Offensive Governance
Legal Authority Frameworks
Offensive engagements require formal legal authority, explicit scope, and controlled execution rules. This framework defines our baseline delivery requirements.
Authority and Control Architecture
Framework quality determines operational safety and legal defensibility. We treat authority verification and control design as first-class workstreams before any technical execution starts.
This protects both client and delivery team by reducing ambiguity in mandate, boundaries, and escalation responsibilities.
Pre-Engagement Controls
- Verified written authority from authorised client representatives.
- Approved target scope, exclusion zones, and operational boundaries.
- Rules of engagement covering timing, escalation, and communications.
- Named decision owners and incident routing model.
Execution Controls
- Evidence capture standards and chain-of-custody handling.
- Secure reporting channels and classification-aware distribution.
- Controlled escalation for high-impact findings.
- Post-engagement remediation and verification workflow.
Governance Artefacts
| Artefact | Purpose |
|---|---|
| Authorisation Instrument | Establishes legal basis and accountable authority for engagement. |
| Rules of Engagement | Defines execution boundaries, exclusions, and escalation rules. |
| Communication Protocol | Specifies secure channels, roles, and decision points. |
| Evidence Handling Standard | Ensures traceability, chain-of-custody, and reporting integrity. |
Policy Statement
No offensive engagement is initiated without validated legal authority and approved operational scope. This is a hard prerequisite across all programme types.
Terminology in Practice
Public copy uses procurement-grade language such as authorised offensive cyber operations, sovereign cyber capability, and formal written authority. This keeps positioning precise while maintaining legal and governance clarity.
- Capability term: authorised offensive cyber operations.
- Procurement term: sovereign cyber capability.
- Control terms: mandate, rules of engagement, authority verification, evidence governance.