As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the…

The Terms of Engagement document specifies exactly what systems may be tested, which actions are authorized versus prohibited, the timeline, and the legal liability boundaries for both parties. It serves as the written authorization that differentiates ethical hacking from criminal activity. Without this document, a tester has no legal protection if the client later disputes the scope or claims damages.

Project Scope only defines which systems or assets are included in the assessment and does not address legal violations, permitted testing methods, or mutual liability protections.

A Non-Disclosure Agreement governs the confidentiality of information shared between parties but does not authorize testing activities or define liabilities for the tester.

A Service Level Agreement defines performance and uptime standards for ongoing services and has no relevance to penetration testing authorization or liability.