A municipal critical finding is fixed mid-engagement and the tester is asked to verify. How should the report treat that work?
Select an answer to reveal the explanation.
Short Explanation
If they patch mid-test and you recheck, say so. Show what was wrong, what changed, and whether the fix held—credit where it is due without erasing history.
Full Explanation
When a municipal critical finding is fixed mid-engagement and the tester is asked to verify, the report should document the original issue, the remediations claimed, and retest verification results within the window—preserving history rather than erasing learning.
Silently dropping the finding as if it never existed hides systemic issues and metrics. Refusing all retests because reports may only show open issues is overly rigid when verification was requested. Marking it critical forever after successful verification misstates residual risk.
Exam caveat: closed-verified items can appear in a remediated section with dates and evidence.
Operational check: retest with the same proof steps, record pass/fail, and place the item in a verified-fixed section of the city report with original severity noted for trend analysis. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.