Which initial procedure should an ethical hacker perform after being brought into an organization?

Beginning security testing before a contract is signed means the hacker has no legal authorization, making the activity potentially illegal regardless of intent.

Turning over deliverables is the final phase of an engagement, not the initial step - it occurs after all testing and reporting are complete.

A formal contract establishes the legal scope of authorization, defines rules of engagement, and protects both the tester and the organization legally. The non-disclosure agreement ensures that sensitive findings and organizational data are protected from unauthorized disclosure. Without this signed agreement, any subsequent testing activity lacks legal authorization and could expose the hacker to criminal liability.

Assessing what the organization wants to protect is part of the scoping and planning phase, which occurs after the formal contract and NDA are signed.