A customer adds a requirement to the scope of a penetration test that states activities can only occur during normal business hours. Which of the following BEST describes why this would be necessary?

While PCI DSS requires penetration testing, it does not specifically mandate that these activities must occur exclusively during normal business hours.

Testing the customer's SLA with their ISP involves different metrics and testing methodologies, and scheduling penetration tests during business hours is not directly related to this.

Limiting activities to business hours often increases the risk of impacting operational bandwidth during peak usage times, which contradicts the goal of avoiding performance issues due to bandwidth limitations.

Restricting penetration testing activities to normal business hours ensures that the client's IT staff and other relevant personnel are available and on-site to immediately address any unforeseen issues, system disruptions, or outages that might occur during the test.