A penetration testing firm based in the United States has been contracted to perform a security assessment for a multinational corporation with operations in several countries, including France. While planning the penetration test, what consideration must the firm take into account in order to remain compliant with the legal restrictions in France?
Focus the penetration test on the corporation's operations outside of France and extrapolate the findings to the French operations.
Ensure explicit consent from the French entity and compliance with French law despite global consent from the corporation.
Obtain a letter of attestation from the corporation's head office in the United States permitting the test.
Proceed with the penetration test as long as the firm does not access any government-owned infrastructure in France.