What if a client asks you to save money by cutting out some of the security measures that you recommended, yet your analysis of the client’s security needs shows that sensitive information will be at risk if you do so? You try to explain this to the client, but he/she is adamant. Should you go ahead and configure the network in a less secure manner? Should you “eat” the cost and install the extra security measures at no cost to the client? Should you refuse to do the job? Would it make a difference if the client’s business were in a regulated industry, and the effect of implementing the lower security standards?
