Requirement
The cybersecurity requirements for penetration testing processes must include at least the following:
Sub-Controls
2-11-3-1
Requirement: Scope of penetration tests which must cover Internet-facing services and its technical components including infrastructure, websites, web applications, mobile apps, email and remote access.
Control Implementation Guidelines:
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Identify and document all services provided online at the organization
- Identify all technical components that support these external services, including:
- Websites and web applications
- Smartphones and tablets applications
- This includes items on Apple Store, Google Play Store and other app stores
- This also includes phone applications that are not available on stores, which are specific to the organization
- API
- Servers used for external services (e.g., web servers)
- Servers used for remote access services
- Servers used by the email service
- Network devices used to provide external services
- Develop and implement an action plan for penetration testing, including the above
Expected Deliverables:
- Cybersecurity policy that covers the penetration testing of the following assets: all services provided externally (online) and its technology components including infrastructure, websites, web applications, smartphone and tablet applications, email and remote access
- Formal approval by the head of the organization or his/her deputy on such document (e.g., via the organization's official e-mail, paper or electronic signature)
- Action plan for penetration testing
- Penetration Testing Reports
2-11-3-2
Requirement: Conducting penetration tests periodically.
Control Implementation Guidelines:
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Develop procedures for penetration testing
- Develop and implement an action plan for the penetration testing showing the annual schedule to be followed for penetration testing on the relevant information and technology assets
Expected Deliverables:
- Cybersecurity policy that covers penetration testing on a regular basis
- Formal approval by the head of the organization or his/her deputy on such document (e.g., via the organization's official e-mail, paper or electronic signature)
- Action plan for penetration testing
- Penetration Testing Reports
