When negotiating a penetration testing contract with a prospective client, which of the following disclaimers should be included in order to mitigate liability in case of a future breach of the client's systems?
A) The proposed mitigations and remediations in the final report do not include a cost-benefit analysis.
B) The NDA protects the consulting firm from future liabilities in the event of a breach.
C) The assessment reviewed the cyber key terrain and most critical assets of the client's network.
D) The penetration test is based on the state of the system and its configuration at the time of assessment.

Question

Quizplus · Accepted Answer

The disclaimer that the penetration test is based on the state of the system and its configuration at the time of assessment helps mitigate liability by clarifying that any future changes to the system or its configuration are not covered by the test results.

When Negotiating a Penetration Testing Contract with a Prospective Client