A company is working with a vendor to perform a penetration test. Which of the following includes an estimate about the number of hours required to complete the engagement?

A Statement of Work (SOW) is a formal document that defines the entire scope of work for a project, including deliverables, timelines, milestones, and, crucially, an estimate of the hours required for completion. This makes it ideal for outlining the specifics of a penetration test engagement with a vendor. A Business Partner Agreement (BPA) is a legal agreement between two business entities, often for a long-term partnership, but it doesn't typically detail the hours for a specific project like a pen test. A Service Level Agreement (SLA) defines the level of service expected from a vendor, focusing on metrics like uptime and response times, not project hours. A Non-Disclosure Agreement (NDA) protects confidential information but doesn't specify project scope or effort.