When conducting a remote penetration test for a client in Utah from Florida, what is the recommended approach to legal compliance?

When conducting a remote penetration test for a client in Utah from Florida, what is the recommended approach to legal compliance?

• A. Florida law
• B. No law
• C. Consult a lawyer on applicable laws and both parties agree
• D. Utah law

Answer: (C)

When testing remotely across state lines, you must have proper authorization that explicitly covers all involved jurisdictions. The safest and most thorough approach is to consult a lawyer to identify which laws apply in both Florida and Utah and to draft an agreement that defines the scope, methods, data handling, and responsibilities, with both parties’ consent. This ensures the engagement is legally backed and that everyone understands and agrees on the terms, reducing the risk of allegations of unauthorized access or overstepping boundaries. Relying on only one state's law or assuming no law applies leaves gaps, and proceeding without legal review is not advisable.

When testing remotely across state lines, you must have proper authorization that explicitly covers all involved jurisdictions. The safest and most thorough approach is to consult a lawyer to identify which laws apply in both Florida and Utah and to draft an agreement that defines the scope, methods, data handling, and responsibilities, with both parties’ consent. This ensures the engagement is legally backed and that everyone understands and agrees on the terms, reducing the risk of allegations of unauthorized access or overstepping boundaries. Relying on only one state's law or assuming no law applies leaves gaps, and proceeding without legal review is not advisable.