During pre-engagement discussions, a penetration testing firm will be given access to a client's proprietary network diagrams, source code repositories, and internal credentials. The client is concerned that sensitive information gathered during testing could be disclosed to competitors, and the testing firm equally wants to protect its proprietary tooling and methodology from being shared. Which document should be executed FIRST to address both parties' confidentiality concerns before any sensitive information is exchanged?