Question

A cybersecurity analyst discovers that a critical vulnerability was never remediated before a compliance deadline. Their manager instructs them to alter the audit report to indicate the issue was fixed, arguing it will 'protect the company's reputation.' Under the ISC2 Code of Ethics, what is the most appropriate action for the analyst?

Accepted Answer

Refuse to falsify the report and act honestly, protecting the profession and the public interest

Answer

Comply with the manager's request, since following organizational directives takes priority over personal judgment

Answer

Alter the report but keep private notes documenting the true findings for personal protection

Answer

Quietly delete the audit records so no inaccurate information is formally recorded