CISSP: Certified Information Systems Security Professional

By ISC · Question Mode

QuestionQ141

VerifiedSecurity Assessment and Testing

A Systems Security Professional (CISSP) with identity and access management (IAM) duties is asked by the Chief Information Security Officer (CISO) to conduct a vulnerability assessment of a web application so it can pass a Payment Card Industry (PCI) audit. The CISSP has never done this previously. Under the (ISC) Code of Professional Ethics, what should the CISSP do?

Explanation

The ISC2 Code of Ethics requires diligent, competent service to principals. A professional who is not fully competent and qualified to perform a web-application vulnerability assessment must disclose that limitation rather than undertake the assessment based solely on CISSP certification or preparatory reading.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!