Standards note
Penetration testing standards, and which part of the work each one governs
No single document covers a whole engagement. Instead, penetration testing standards divide the work: one sets the phases, one sets the web method, one sets the reporting language. So the useful question is which standard governs which step.
- Written scope and rules of engagement
- PTES, OWASP and NIST SP 800-115
- Nothing retained after close
Why penetration testing standards matter to a buyer
A test run to a published standard can be checked by someone who was not in the room. Therefore an auditor, a customer or your own engineers can read the report and see what was done, in what order, and why.
Without a named standard, two firms can sell the same label and deliver very different work. So asking which standards apply is the quickest way to compare proposals.
The five penetration testing standards we work to
Also, each one answers a different question. Consequently they are complementary rather than competing.
| Standard | What it governs | Where it shows in the report |
|---|---|---|
| PTES | The phase order, from pre-engagement to reporting. | The structure of the engagement. |
| OWASP testing guide | How web applications and APIs are tested. | Application findings and coverage. |
| NIST SP 800-115 | Planning, executing and reporting technical assessments. | Method notes and limitations. |
| MITRE ATT&CK | A shared vocabulary for attacker behaviour. | How each step of a chain is labelled. |
| CVSS | A common severity score. | The rating beside every finding. |
Do your proposals name their penetration testing standards?
Tick what each proposal states in writing. Gaps show where to ask.
Your result appears here as you tick, so you can see what is still open.
How penetration testing standards fit into one engagement
The Penetration Testing Execution Standard sets the order: scoping, intelligence gathering, threat modelling, analysis, exploitation and reporting. Within that order, the OWASP Web Security Testing Guide defines the application tests, and NIST SP 800-115 frames planning and reporting.
Then MITRE ATT&CK labels each step of an attack path, so defenders can map it to their detections. Finally, CVSS, maintained by FIRST gives every finding a severity your risk team can compare.
What standards do not decide
However, a standard cannot choose your scope or your priorities. So the written scope still decides what is tested, and your threat model still decides what matters most. Also, no standard replaces judgement: chaining findings into a real route is the part a document cannot automate.
Fees and the bounded first step
Full engagements usually settle between $35,000 and $120,000, and the floor is $25,000. The bounded Security Posture Assessment starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. Every fee is fixed after a written scoping brief, so there is no hourly billing.
Questions about penetration testing standards
Is there one official standard for penetration testing?
No. Several published frameworks each cover part of the work, so mature engagements combine them.
Which penetration testing standards do auditors recognise?
Auditors usually look for a named method, a defined scope and evidence of retesting, rather than one specific framework.
Does following penetration testing standards make the test slower?
Not really. However, it makes the work repeatable, so a second test can be compared with the first.
Do penetration testing standards cover cloud systems?
Partly. Cloud providers also publish their own testing policies, so those are checked during scoping.
Related guides
Request a scope built on penetration testing standards
Describe the estate and the threat. We return a written scope that names each standard and what it governs, with a fixed fee. Nothing is tested before the owner signs.
Request a written scope