If the engineer has a problem now, they'll have a complete mental breakdown during a standard SOC/ISO certification. However, the director also does not seem p

If the engineer has a problem now, they'll have a complete mental breakdown during a standard SOC/ISO certification. However, the director also does not seem politic enough to maintain plausible deniability, if they're saying "what the fuck, just sign your name uncritically on this statement" vs guiding them towards a long, detailed, qualified, technically-truthful answer. ("We did these things on these dates" and leave it up to client to evaluate whether its sufficient/is really pen testing) Which the client would require anyway if the process moves forward. The entire situation just seems like a shitshow.