A penetration testing firm has an existing Master Service Agreement (MSA) with a client that establishes general legal terms, liability limits, and confidentiality obligations. Midway through planning a new web application assessment, the client asks to add two additional subdomains and extend the testing window by three days. The lead tester wants to formalize these specific changes without renegotiating the overarching legal relationship. Which document should be used to capture these engagement-specific details?