Company policies must be followed in this situation

Laws supersede corporate policies

Industry standards receding scanning should be followed

The employee must obtain written approval from the company's Chief Information Security Officer (ClSO) prior to scanning

ICS vendors are slow to implement adequate security controls.

ICS staff are not adequately trained to perform basic duties.

There is a scarcity of replacement equipment for critical devices.

There is a lack of compliance for ICS facilities.

Letter of engagement and attestation of findings

NDA and MSA

SOW and final report

Risk summary and executive summary