A mayor's office asks who can authorize a penetration test against city systems. Which answer is professionally correct?
Select an answer to reveal the explanation.
Short Explanation
Authorization is not a hallway high-five. You need the real owner — or someone officially designated — on paper before packets fly. An eager intern with local admin is not the city.
Full Explanation
Authorization to pentest city systems must come from a proper system or data owner or another designated authority who provides written approval. Informal enthusiasm from non-owners does not create lawful cover. An intern with local admin on a laptop is not a municipal authorizing official for citywide testing. Social-media likes on a city post are not consent for intrusive security testing. Vendor sales engineers may demo products, but they do not substitute for the city's written authorization unless the city has explicitly delegated that authority in the engagement paperwork. Exam caveat: written approval should name systems, time boxes, and contacts; verbal hallway permission is insufficient for CPTS-style professional practice on civic infrastructure. Operational check: verify the signatory's role against the city's authorization matrix, retain the signed letter of engagement, and refuse to start active testing until that document is on file with the mayor's office or designated CISO delegate. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.