When Negotiating a Penetration Testing Contract with a Prospective Client

Multiple Choice

When negotiating a penetration testing contract with a prospective client, which of the following disclaimers should be included in order to mitigate liability in case of a future breach of the client's systems?

A) The proposed mitigations and remediations in the final report do not include a cost-benefit analysis.
B) The NDA protects the consulting firm from future liabilities in the event of a breach.
C) The assessment reviewed the cyber key terrain and most critical assets of the client's network.
D) The penetration test is based on the state of the system and its configuration at the time of assessment.