A Client's Systems Administrator Requests a Copy of the Report

Multiple Choice

A client's systems administrator requests a copy of the report from the penetration tester, but the systems administrator is not listed as a point of contact or signatory. Which of the following is the penetration tester's BEST course of action?

A) Send the report since the systems administrator will be in charge of implementing the fixes.
B) Send the report and carbon copy the point of contact/signatory for visibility.
C) Reply and explain to the systems administrator that proper authorization is needed to provide the report.
D) Forward the request to the point of contact/signatory for authorization.