You are about to be hired by a well known Bank to perform penetration tests. Which of the following documents describes the specifics of the testing, the associated violations, and essentially protect

A Service Level Agreement (SLA) defines performance metrics and uptime guarantees for ongoing services; it does not govern the specific authorized actions and liabilities of a security test.

A Non-Disclosure Agreement (NDA) covers confidentiality of information shared between parties but does not define testing scope, permitted violations, or tester liabilities.

The Terms of Engagement formally establishes what systems may be tested, what techniques are authorized, the timeline, escalation procedures, and the legal protections for both the tester and the client. It is the primary document that prevents unauthorized activity from being classified as criminal and ensures the bank's assets are protected within agreed boundaries.

A Project Scope document outlines deliverables and boundaries of a project in general terms but lacks the legal authorization language, violation definitions, and liability protections specific to penetration testing engagements.