Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Focus area · Pentesting
Penetration Testing
How authorised security testing is scoped, governed and reported, and how findings feed risk decisions.
Penetration testing is authorised, simulated attack against systems to find exploitable weaknesses before adversaries do. Its value depends far more on scoping, rules of engagement and reporting than on any single tool or technique.
For GRC teams, a penetration test is also evidence. PCI DSS requires regular internal, external and segmentation testing. FedRAMP and many customer contracts expect independent testing. Knowing what a good test plan and report look like makes those obligations useful rather than ceremonial.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- Scoping and rules of engagement
- Written authorisation, in-scope and out-of-scope assets, permitted techniques and stop conditions.
- Testing methods
- Network, web application, API and cloud configuration testing approaches and methodologies.
- Severity rating and reporting
- Findings that engineers can reproduce and leaders can prioritise.
- Remediation and retesting
- Tracking findings to verified closure through vulnerability management.
Related frameworks
Where does Pentesting show up in the rules?
Industry standard
PCI DSS
The global industry standard of technical and operational requirements for any entity that stores, processes or transmits payment account data, or can affect its security.
Attestation framework
SOC 2
An independent CPA examination that reports on how a service organisation's controls meet the AICPA Trust Services Criteria.
Government programme
FedRAMP
The US government programme that standardises security assessment and authorisation of cloud services used by federal agencies, now moving from Rev5 baselines to the automation-focused FedRAMP 20x model.
Reading
Guides and explainers
Technical explainer
Penetration Test Scoping and Rules of Engagement: What a Good Test Plan Covers
Authorised penetration testing starts long before the first scan. What to agree on scope, authorisation, rules of engagement, reporting and retesting — and what frameworks like PCI DSS expect.