If you accept a penetration test contract, make sure that your get-out-of-jail-card contract is not only rock solid, but also very specific about what you are expected to do, and who will know about it at the contracting organization, and exactly what to do if you are discovered during the test.
This advice is particularly critical of you include physical penetration testing.
"Authorities later found out the state court administration did, in fact, hire the men to attempt "unauthorized access" to court records "through various means" in order to check for potential security vulnerabilities of Iowa's electronic court records, according to Iowa Judicial Branch officials."
"The men were employed with Coalfire, a cybersecurity advisor headquartered out of Colorado, Iowa Judicial Branch spokesman Steve Davis confirmed. "
I have successfully with and had good success with Coalfire so I am surprised they overlooked the GOOJFC so easily. If nothing else its something beaten into your head in certain SANS training courses.