Which of the following steps ensures that the organization's senior management has formally approved the test, acknowledges the risks, and outlines responsible parties and legal considerations?

• A. Planning
• B. Authorization
• C. Debrief
• D. Scoping

Answer: (B)

Authorization is the formal sign-off from senior management to conduct the assessment. It captures that management acknowledges the risks, assigns responsibility for actions and decisions, and lays out legal and compliance considerations such as permitted activities, data handling, and notification procedures. This formal approval creates a clear accountability trail and helps prevent disputes about legitimacy or scope if anything goes wrong.

Planning focuses on designing how the test will be carried out—methods, resources, and timelines. Debrief happens after the test to review results and lessons learned. Scoping defines what is in or out of bounds, but without formal approval and explicit risk and legal acknowledgments, it lacks the authorized authority to proceed.