Penetration testing should only be used once which of the following items is in place?

Penetration testing should only be used once which of the following items is in place?

A.
Acceptable use policy

B.
Data retention and disclosure policy

C.
Service level agreement

D.
Written permission