When negotiating a penetration testing contract with a prospective client, which of the following disclaimers should be included in order to mitigate liability in case of a future breach of the…

Omitting cost-benefit analysis from remediation recommendations is a scope limitation, not a liability protection mechanism, and does not shield the firm from claims arising from a future breach.

An NDA is a confidentiality instrument designed to prevent disclosure of sensitive information - it does not function as a liability waiver and cannot protect the firm from breach-related claims.

Documenting which assets were reviewed defines the test's coverage scope but does not create a legal defense against future liability for incidents occurring after the engagement.

A point-in-time disclaimer explicitly limits the scope of the assessment to the system's configuration at the moment testing was performed. This protects the penetration testing firm because patches, new vulnerabilities, or misconfigurations introduced after the engagement are outside the tester's responsibility. Without this clause, a client could attempt to hold the firm liable for a later breach even if the tested environment was secure during the assessment.