During contract negotiations for a web application penetration test, the client asks that any remediation validation (retesting) of previously reported findings be included in the engagement terms. The penetration testing firm wants to ensure the retest is properly bounded and does not become an open-ended obligation. Which document and provision should the firm use to define the timing, scope, and cost of the retest?