While engaging clients for a penetration test from highly regulated industries, which of the following is usually the MOST important to the clients from a business perspective?

A letter of engagement and attestation of findings are procedural and legal documents used to authorize the test and confirm completion, not to communicate actionable risk information to business stakeholders.

An NDA and MSA establish the confidentiality and contractual relationship before the engagement, but neither document conveys vulnerability findings or business risk to the client organization.

The SOW defines scope and deliverables, and the final report contains technical details - but neither is written for executive or regulatory audiences in the way a risk or executive summary is.

Regulated industries such as finance, healthcare, and government must demonstrate risk management and compliance accountability to internal leadership and external regulators. A risk summary prioritizes vulnerabilities by business impact rather than technical severity, while an executive summary communicates findings in non-technical language that enables strategic decision-making and satisfies regulatory reporting requirements - directly serving the client's core business obligations.