Safeguard 18.1 Penetration testing program
The penetration testing program that sets scope, frequency, limitations, contacts, remediation routing and retrospectives, sized to the enterprise; the governing safeguard for Control 18.
Control 18 Penetration testing
CIS Control 18 covers testing how effective and resilient enterprise assets are by finding and exploiting weaknesses in people, processes and technology: the testing program, external and internal tests, remediation and validating security measures.
Safeguard 18.2 External penetration tests
Running external penetration tests at least annually through a qualified party, including reconnaissance for exploitable information, as clear box or opaque box tests.
Safeguard 18.3 Remediate penetration test findings
Remediating penetration test findings under the documented vulnerability remediation process, with timelines and effort set by impact and priority.
Safeguard 18.4 Validate security measures after testing
Validating security measures after each penetration test and adjusting detection rulesets and capabilities to catch the techniques the testers used; an IG3 safeguard.
Safeguard 18.5 Internal penetration tests
Running internal penetration tests at least annually, as clear box or opaque box tests; the IG3 counterpart to the external tests in 18.2.
