A SaaS vendor that hosts the city’s permit portal sends its own pen…

Question

A SaaS vendor that hosts the city’s permit portal sends its own penetration-test report as proof of security. What is the most appropriate way for the city to treat that evidence?

Accepted Answer

Treat the vendor-supplied pentest as useful input but still verify scope, independence, findings, and remediation before relying on it — Vendor-run tests are like a restaurant grading its own kitchen—helpful, but not the whole story. Use the report, then check who tested what, how independent they were, and whether fixes actually landed.

Answer

Accept the vendor’s pentest report as conclusive assurance and skip any further third-party risk review

Answer

Discard all vendor-provided testing evidence because only city-run scans are allowed under Security+

Answer

Replace the vendor immediately whenever a self-assessment or self-funded test appears in the packet

A SaaS vendor that hosts the city’s permit portal sends its own penetration-test report as proof of security. What is the most appropriate way for the city to treat that evidence?

Short Explanation

Full Explanation