A client wants a penetration test report safe for executives and engineers to share internally. What should the reporting plan specify?

1. No distinction between confirmed impact and untested hypotheses
2. Audience-appropriate sections, sensitive-evidence handling, and approved distribution
3. Automatic release to the public before client review
4. Publication of every captured secret in the executive summary