During testing, where are the requirements to inform parent organizations, law enforcement, and a computer incident response team documented?

Unit test results are outputs that document the outcomes of individual software component tests and do not contain procedural or legal notification requirements for organizations or law enforcement.

The Security Assessment Plan (SAP) is the authoritative document that establishes the scope, rules of engagement, and procedural requirements for a security assessment, including mandatory notification requirements to parent organizations, law enforcement, and CIRTs if testing triggers incidents or discoveries. It defines these obligations before testing begins so all stakeholders understand their roles and legal requirements. This is aligned with NIST SP 800-53A and FedRAMP SAP guidance, which require such escalation and notification procedures to be pre-documented in the plan.

A System Integration Plan describes how system components are combined and interfaces are managed during integration, not the legal and organizational notification requirements during security testing.

The Security Assessment Report (SAR) is a post-assessment artifact that documents findings, vulnerabilities, and recommendations after testing is complete, not the pre-established requirements and rules of engagement that govern the testing process.