You are about to be hired by a well known Bank to perform penetration tests. Which of the following documents describes the specifics of the testing, the associated violations, and essentially protect

A Service Level Agreement defines performance metrics and service delivery expectations, not the legal boundaries or liability protections specific to penetration testing.

A Non-Disclosure Agreement covers confidentiality of information exchanged, but does not define testing specifics, permitted techniques, or liability protections.

The Terms of Engagement formally defines what tests are authorized, the methods allowed, legal boundaries, consequences for violations, and protections for both parties. It serves as the legal and operational contract that governs the entire penetration testing engagement, shielding the bank from unauthorized activity and the tester from liability.

A Project Scope document defines what systems or assets are in or out of scope but does not address violations, legal protections, or tester liability.