You are a CEH, and a company approaches you and asks you to break into their system. They give you a web address, and the forward-facing IP address. What are some things you must verify before you start to hack?

The company is listed in the Better Business Bureau's website, and in good standing with local law enforcement; the company's infrastructure is not too hard to break into; and you have all of the passwords.

Information which is obtained is only used/stored for usage in the hack itself, or to be released only to the verified customer; there is a clear plan of attack which is scheduled, or determined as unscheduled; the depth of intrusion is discussed, and the

There are clear limitations as to what can be accessed; the people who approached you are from the company in question; the routes/methods of attack are approved by those in charge; only financial information which you deem useful is stored off-site

The people who approached you are from the company in question; there are clear limitations as to what can be accessed; the routes/methods of attack are approved by those in charge; only personal information which you deem useful is stored off-site

Explanation

You cannot store the information, or use the information for any other reason then to perform the attack. Any data which was not requested by a verified customer and which is not legally able to be released, must be discarded. The person who has requested the attack must be verified as the owner of the system(s). The attack must be coordinated in scope, and unless requested otherwise, at a certain time. There must be a clear limitation on what can and cannot be accessed. If there are systems which must be used to facilitate the attack, permission must be gained from those entities as well.