During pre-engagement planning for a black-box external penetration test, the client asks how the testing team will handle situations where a discovered vulnerability could lead to accidental service disruption or evidence of a prior compromise. The lead penetration tester wants to formally document who must be notified, under what conditions, and through which channels before defining these details in the rules of engagement. Which pre-engagement element most directly addresses this requirement?