During a penetration test phase of a security project, the tester discovers a critical finding outside the agreed scope. What should the project manager do?
-
A
Instruct the tester to exploit the finding immediately
-
B
Ignore the finding as it is out of scope
-
C
Raise a change request and notify relevant stakeholders before proceeding
-
D
Expand scope unilaterally to include the finding