An assessor documents vendor-specific WPS implementation bugs as a finding class on mixed municipal hardware. What reporting principle applies?

When documenting vendor-specific WPS implementation bugs on mixed municipal hardware, cite observed behavior on the tested APs rather than assuming every vendor is equally exploitable. Professional civic reporting stays evidence-based: lockouts, patches, and firmware differ. Blanket identical-critical ratings without observation weaken credibility.

'Mark all WPS-capable APs identically critical even when lockouts and patches differ' fails because marking all WPS-capable APs identically critical ignores lockouts and patch differences. 'Omit WPS findings unless every AP in the county shares one firmware build' fails because omitting WPS findings unless every AP shares one firmware build invents an impossible reporting bar. 'Claim offline recovery always works whenever the wash scan shows WPS enabled' fails because wash-scan WPS enabled does not prove offline recovery always works on that device.

Exam caveat: enabled WPS is still worth inventorying even when exploitability varies—say what you saw. Operational check: table municipal AP models, WPS state, lock behavior, and test results separately; recommend disable globally; escalate only proven vulnerable classes with evidence. Keep firmware versions in the appendix. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.