Question

A penetration tester is midway through a two-week engagement for a healthcare client. The client's CISO requests that the team stop testing the legacy billing application and instead focus remaining hours on a newly deployed patient portal that was not in the original scope document. The tester wants to accommodate the request while remaining compliant with the engagement's governance requirements. What should the tester do FIRST?

Accepted Answer

Obtain a written scope change (change request/amendment) authorizing the patient portal before testing it

Answer

Begin testing the patient portal immediately, since the CISO has authority over the client's security program

Answer

Continue testing the billing application as originally scoped and note the CISO's request in the final report

Answer

Perform a quick vulnerability scan of the patient portal to confirm it is worth including, then request authorization