If were referring to other devices, yes - Implement BIOS passwords before they are compromised. But the ones that were already compromised, they need to be removed from the system to avoid further exploitation. Plus, if you put a password on there, the attacker may now have your password.
Remove the assets from the production network for analysis. If the analyst receives an alert about unauthorized changes to the firmware versions on several field devices, the best action to recommend to the asset owners is to remove the assets from the production network for analysis. This would prevent further exploitation of the devices by isolating them from potential attackers and allow the analyst to investigate the source and nature of the unauthorized changes. Changing the passwords on the devices, implementing BIOS passwords, or reporting the findings to the threat intel community are other possible actions, but they are not as effective or urgent as removing the assets from the production network for analysis. Reference: https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901

The testing is outside the contractual scope is the most dangerous to the client environment during a vulnerability assessment penetration test. A contractual scope defines the boundaries and limitations of the testing, such as the target systems, networks, applications, methods, techniques, tools, time frame, and deliverables. Testing outside the contractual scope can violate the agreement between the tester and the client and cause legal or ethical issues. Testing outside the contractual scope can also damage or disrupt the client environment by affecting systems, networks, applications, or data that are not authorized or intended for testing. Testing outside the contractual scope can also compromise the validity and reliability of the test results and recommendations. There is a longer period of time to assess the environment (A) is not necessarily dangerous to the client environment during a vulnerability assessment penetration test. A longer period of time can allow for more thorough and comprehensive testing and analysis of the vulnerabilities and risks in the client environment. However, a longer period of time can also increase the exposure and likelihood of detection by attackers or defenders. There is a shorter period of time to assess the environment is also not necessarily dangerous to the client environment during a vulnerability assessment penetration test. A shorter period of time can reduce the exposure and likelihood of detection by attackers or defenders. However, a shorter period of time can also limit the depth and breadth of testing and analysis of the vulnerabilities and risks in the client environment. No status reports are included with the assessment (D) is not dangerous to the client environment during a vulnerability assessment penetration test. Status reports are documents that provide updates on the progress and findings of the testing to the client or stakeholders. Status reports can help to communicate effectively and transparently with the client or stakeholders and address any issues or concerns that may arise during the testing. However, status reports do not directly affect the client environment or its security.

Nessus is a vulnerability scanning and assessment tool that can be used to scan systems for potential vulnerabilities and weaknesses. It provides detailed reports on any critical and high-severity findings as referenced in the CVE database, making it the ideal tool for fulfilling the Chief Information Security Officer's request. Nikto, fuzzer, wireshark, and prowler are all security tools, but they are not applicable for the scenario described in the question. Here is a link to an article from CompTIA's website about Nessus for your reference: https://www.comptia.org/content/nessus-vulnerability-scanning-and-assessment-tool.

https://legalshred.com/degaussing-vs-hard-drive-shredding/
The best and most secure method of rendering hard drive information completely unusable is to completely destroy it through hard drive shredding Shredding is a method of physically destroying storage media files by cutting them into small pieces using a machine called a shredder. Shredding can ensure that confidential data from storage media files is sanitized so the drives cannot be reused, as it makes it impossible to recover any data from the shredded pieces.

A Diamond Model analysis of an incident is a framework that identifies the four essential features of an attack: adversary, capability, infrastructure, and victim1 By analyzing these features and their relationships, a security analyst can gain insights into the attack's objectives, methods, sources, and targets. A potential benefit of this activity is that it can identify detection and prevention capabilities to improve, such as gaps in security controls, indicators of compromise, or mitigation strategies2