Any deviations from the Security Assessment plan should be________? Response:

While documentation is essential, it alone is insufficient without communicating and highlighting the deviation.

Emailing is important for communication but without documentation and flagging, the deviation may not be properly recorded or prioritized.

Flagging ensures visibility but without documentation and broader communication, the context and impact may be lost.

When deviations occur during a security assessment, it is crucial to document them to maintain an audit trail and accountability. Emailing ensures that all relevant stakeholders are informed promptly, and flagging them ensures they are highlighted for immediate attention, review, and potential remediation, supporting comprehensive risk management.