Question

A CISSP-certified security consultant discovers that a client's flagship product contains a serious vulnerability that could expose customer financial data. The client's executive team instructs the consultant to keep the finding confidential to protect the company's reputation and stock price, and reminds the consultant of the signed nondisclosure agreement. Following the ISC2 Code of Ethics, how should the consultant prioritize their obligations when deciding what to do?

Accepted Answer

Give precedence to protecting society and the public infrastructure over duties to the principal (client), acting to see the vulnerability responsibly addressed

Answer

Honor the NDA and remain silent, since protecting client confidentiality is the consultant's primary duty

Answer

Immediately disclose the vulnerability publicly on social media to force the client to act

Answer

Defer entirely to the executives' business judgment, since aligning security with business objectives is the consultant's obligation