After performing a security assessment for a firm, the client was found to have been billed for the time the client's test environment was unavailable. The Client claims to have been billed…

A Statement of Work (SOW) explicitly defines the services to be rendered, the conditions under which billing applies, and the responsibilities of each party during the engagement. It would specify whether client-side test environment downtime is a billable condition or an excluded circumstance, making it the authoritative reference for resolving this billing dispute.

A Non-Disclosure Agreement (NDA) governs the confidentiality of information shared between parties and contains no provisions related to billing or service availability.

An End User License Agreement (EULA) pertains to the terms of use for software products and is not applicable to professional consulting or penetration testing service billing.

A Business Risk Assessment (BRA) is an internal document evaluating organizational risks and does not define contractual billing obligations between a client and a tester.