A financial services client requires that a penetration testing firm follow a formally recognized, government-published framework so the assessment maps cleanly to the client's existing security control audits. The client specifically wants the technical testing to align with a structured four-phase process (planning, discovery, attack, and reporting) that their internal auditors already reference. Which methodology should the testing firm adopt to best satisfy this requirement?