A township contractor asks a security architect to soft-pedal assessment findings so a favorite vendor keeps the renewal. What should the architect do?
Select an answer to reveal the explanation.
Short Explanation
Loyalty to a favorite vendor is not a security control. Soft-pedaling findings is like telling the fire marshal the smoke detector chirp is just 'ambiance.' Accurate reporting protects the township; diluted reports protect someone's renewal, not the public.
Full Explanation
Accurate and complete risk reporting is a core professional obligation. When a township contractor asks a security architect to soft-pedal assessment findings so a preferred vendor keeps a renewal, the architect must report findings accurately and refuse to dilute risk statements for vendor loyalty. Dilution converts an assessment into marketing, deprives decision-makers of truthful residual risk, and can leave public systems under-protected while a commercial relationship is preserved.
Rewriting the report to omit high findings in exchange for a promised free upgrade is bribery-adjacent influence on professional judgment and directly conflicts with honest service. Sharing the draft only with the contractor so the vendor can pre-negotiate language creates an improper advocacy loop that undermines independence of the assessment and invites managed optics rather than managed risk. Marking every finding low to preserve the relationship abandons severity as an objective judgment and trains leadership to distrust future reports.
Exam caveat: Vendor-pressure scenarios on the exam are ethics and due-care tests. Prefer truthful communication of risk over relationship preservation, even when the vendor is popular with procurement or elected officials.
Operational check: Use an approved findings severity rubric, route reports through an independent review path that the vendor cannot edit, escalate any request to alter severity for commercial reasons, and retain the original evidence package supporting each finding.