Which of the following should a company require prior to performing a penetration test?