The statement of work (SOW) is a formal document that captures and defines the work activities, deliverables, and timeline a vendor must execute in performance of specified work for a client. The other options, such as a Non-disclosure agreement and Service-level agreement, are important legal documents, but they do not typically detail the specifics of the tasks and objectives of a penetration test.