An independent researcher privately reports a flaw in the city permit portal. What process should the city follow?
Select an answer to reveal the explanation.
Short Explanation
A good-faith report is a free heads-up—treat it with an ethical disclosure path: thank, validate, fix, communicate. Threats first, radio silence, or doxxing burn trust and leave citizens exposed.
Full Explanation
Ethical disclosure practices give organizations a structured way to receive external research, validate findings, remediate, and communicate appropriately. When an independent researcher privately reports a flaw in the city permit portal, the city should acknowledge receipt, validate the issue safely, remediate under a coordinated timeline, and communicate responsibly—protecting citizens while treating the researcher as a good-faith partner rather than an adversary by default.
Threatening legal action immediately without evaluating the report chills beneficial research and may delay fixing a real exposure. Ignoring the researcher and hoping the issue stays quiet leaves residents at risk and often leads to uncoordinated public disclosure later. Publicly doxxing the researcher before validation is unethical, potentially unlawful, and irrelevant to fixing the portal.
Exam caveat: CISSP-aligned practice favors coordinated/ethical disclosure processes over reflexive legal threats or silence. When stems describe private good-faith reports, choose acknowledge–validate–remediate–communicate.
Operational check: Publish a security contact and disclosure policy for city services, ticket inbound reports, validate in a non-destructive environment, keep the researcher updated on status without premature full technical public dump, and credit or coordinate disclosure after fix or agreed timeline.