Organizations sometimes require these to feel comfortable with the penetration testing teams, that they are allowing to access their environment and information.

Limiting invasiveness based on scope.

Adherence to the specific scope of engagement.

Limiting the use of tools to a particular engagement.

Confidentiallity of data and information.

Risks to the professional.

Background checks of penetration testing teams.

Identification of criminal activity, an immediate reporting of breaches$/$criminal activities.