you were contracted by a private firm to conduct an external security assessment through penetration testing . What document describes the specifics of the testing