5 docs tagged with "pentesting"

Strategies and practices for continuously validating application security through automated, manual and offensive testing.

Organisational policy that defines the requirements for the execution of offensive penetration tests (PenTesting), including scope and formal authorisation, test modalities, rules of engagement, minimum report content, the remediation and retest process, cadence by criticality level and integration with the findings process, proportionate to the criticality level (L1, L2, L3).

Execution of controlled manual tests to identify vulnerabilities not detected by automated mechanisms.

Strategies and practices for continuously validating application security through automated, manual and offensive testing

Canonical catalogue of requirements for the security testing programme (TST-001 to TST-010), with applicability by risk level and acceptance criteria for testing strategy, SAST, DAST, findings management, regression, pentesting and auditable evidence.