Skip to content

Pretexting

What is Pretexting?

A social engineering technique where an attacker creates a fabricated scenario to engage a victim and trick them into divulging information or taking action.

Information Security

Frameworks that govern pretexting

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on pretexting

Requirements naming pretexting across 4 standards, quoted from the control text.

FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011)2 controls

FCC CPNI rules + Section 222 of the Communications Act are the principal US federal telecommunications-privacy framework. Status: REGULATIONS IN FORCE since 1996 (Section 222) + 1998 (initial FCC CPNI Order) + 2007 + 2009 + 2011 + 2017 amendments.

CPNI-Status · FCC CPNI - corpus status, enforcement landscape, broadband privacy →
CIS Controls v81 control

Teach the workforce to spot social engineering, for example phishing, pretexting and tailgating.

CIS-14.2 · Train Workforce Members to Recognize Social Engineering Attacks →
CIS Controls v8.11 control

Teach staff to spot social engineering, including phishing, business email compromise, pretexting and tailgating. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it). Asset type: Users.

cis-controls-v8-1::14.2 · Train Workforce Members to Recognize Social Engineering Attacks →
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)1 control

Apply Section 5 target vulnerability validation including: password cracking (offline against captured hashes per RoE + John the Ripper + Hashcat + dictionary attacks + rainbow tables) + penetration testing (Sections 5.2 + 5.3 covering planning + discovery + a...

NISTSP115-4 · Target Vulnerability Validation - Password Cracking, Pen Testing, Social Engineering →

Questions people ask about pretexting

What is Pretexting?
A social engineering technique where an attacker creates a fabricated scenario to engage a victim and trick them into divulging information or taking action.
Why is Pretexting important for compliance?
Pretexting is a key concept in Information Security. Understanding pretexting helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Pretexting?
Pretexting appears in the requirement text of FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011), CIS Controls v8, CIS Controls v8.1, NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment). Across these standards we have identified 5 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Pretexting?
Explore our compliance framework pages to see how pretexting applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Pretexting applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.