A city CISO asks why encrypting the assessor's generic wordlist on disk matters less than locking down cracked guest PSKs and client identifiers from the engagement. What is the best answer?

A city CISO asking why encrypting the assessor's generic wordlist on disk matters less than locking down cracked outputs is highlighting data classification: cracked PSKs and related client data are high-sensitivity engagement outputs that demand stricter handling than public wordlist files. Rockyou-class lists are widely published; recovered municipal guest keys and client identifiers are not. Protect the crown jewels created during the test.

'Wordlists contain live RADIUS secrets, so they always outrank recovered guest keys' fails because public wordlists do not contain live RADIUS secrets that outrank recovered guest keys. 'Cracked PSKs are worthless once written in the report PDF, so disk encryption is optional' fails because cracked PSKs remain sensitive even after appearing in a report PDF—disk controls still matter for working copies. 'Client identifiers may be published freely under municipal open-records law during tests' fails because client identifiers must not be published freely during tests under a casual open-records assumption.

Exam caveat: good wordlist hygiene still matters for integrity, but it is not the same sensitivity tier as recovered live credentials. Operational check: encrypt and access-control engagement evidence folders containing cracked PSKs, proof files, and client identifiers; keep generic lists in ordinary tool storage. Review municipal data-handling checklists before transferring results to the client portal. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.