Penetration Testing
What is Penetration Testing?
An authorised simulated cyberattack against a system to evaluate its security. Identifies vulnerabilities that could be exploited by real attackers.
Related terms
Frameworks that govern penetration testing
What the standards actually require on penetration testing
Requirements naming penetration testing across 6 standards, quoted from the control text.
External penetration testing is performed at least once every 12 months and after any significant infrastructure or application upgrade or change.
11.4.3 · External penetration testing annually →Penetration Testing. Penetration testing tools are used internally so testing scales beyond periodic external engagements.
PT1.3 · Use penetration testing tools internally →Conduct external penetration testing of a scope sufficient to satisfy the scope requirement, at a frequency determined by an appropriate risk analysis and no less frequently than annually for covered entities, with the required annual test performed by indepen...
CFTC-SS-14 · External Penetration Testing →Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing.
CIS-16.13 · Conduct Application Penetration Testing →Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
CA-8(1) · Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components →Independent penetration testing is performed annually on external and internal environments with findings remediated.
IS-V.B.2 · Penetration Testing →Questions people ask about penetration testing
What is Penetration Testing?
Why is Penetration Testing important for compliance?
What concepts are related to Penetration Testing?
Which compliance frameworks address Penetration Testing?
Where can I learn more about Penetration Testing?
See how Penetration Testing applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.