A client's systems administrator requests a copy of the report from the penetration tester, but the systems administrator is not listed as a point of contact or signatory. Which of the following is…

Sending the report based solely on operational role violates the confidentiality controls defined in the engagement contract, regardless of what the recipient intends to do with it.

Carbon-copying the point of contact does not constitute prior authorization - the report would still be delivered to an unauthorized party before approval is granted.

The Rules of Engagement and Statement of Work define exactly who is authorized to receive deliverables such as the penetration test report. Since the systems administrator is not listed as a point of contact or signatory, sharing the report without authorization would violate the confidentiality terms of the engagement. Directly informing the requester of the authorization requirement is the most transparent and professionally responsible course of action.

Forwarding the request without informing the requester is less direct and leaves the systems administrator without guidance on what authorization steps are actually required.