Ratio Corp is undergoing a security control assessment for its new information system. The assessor has identified a vulnerability that could lead to unauthorized access to the system. Which of the following is the most appropriate action for the assessor to take?