Which of the following documents does Heather need to submit before performing the additional task if she is in the middle of performing a penetration test when her client asks her to also check the security of an additional server?