A company that is hiring a penetration tester wants to exclude social engineering from the list of authorized activities. Which of the following documents shoul...