The testing standards library

Why a testing standards library

Depth comes from method, because badges prove little. Therefore every engagement follows published frameworks, and the report can be checked against them by someone who was not there.

Each note stands alone. However, they also link to each other, so you can move from a general question to a specific engagement.

What every engagement shares

First, a written scope and signed authorisation. Then manual-led testing, a report with reproducible routes, a written debrief and a retest. Finally, evidence is destroyed when the work closes.

Fees are fixed before testing starts. Also, a bounded assessment exists for organisations that need one clear answer first.

Frameworks covered by the testing standards library

The published standards and how they shape the work.

• Penetration testing standards
• OWASP penetration testing
• NIST 800-53 penetration testing
• Vulnerability assessment and penetration testing
• NIST CSF penetration testing
• ASVS penetration test
• FFIEC penetration testing
• GLBA penetration testing

Engagement notes in the testing standards library

What to agree first, and one collaborative format.

• Penetration testing contract
• Purple team penetration testing
• Non intrusive penetration testing