After completing a penetration test, the tester is preparing the final report. The client asks the tester to remove a critical finding from the report because it would embarrass a senior IT manager. What is the MOST appropriate response?

Question

Accepted Answer

C. Retain the finding with full accuracy and explain to the client why omitting it is inappropriate. Penetration test reports must be accurate and complete to serve their purpose of helping the organization improve its security posture. Omitting or downgrading valid critical findings at client request compromises the integrity of the report, may expose the organization to ongoing risk, and could raise ethical and legal liability concerns for the tester. Professional and ethical standards require that findings be reported accurately.

After completing a penetration test, the tester is preparing the final report. The client asks the tester to remove a critical finding from the report because it would embarrass a senior IT manager. What is the MOST appropriate response?

Related Questions

Discussion