Establish and Maintain a Penetration Testing Program
Description
Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.
Implementation Checklist
Tool Recommendations
Continuous security testing platform with bug bounty programs, managed pentesting, and vulnerability disclosure
HackerOne · Program-based subscription
Crowdsourced security testing platform with vetted researchers, AI-enhanced pentesting, and continuous assessment
Synack · Asset-based subscription
Pentest as a Service platform with vetted pentesters, programmatic testing, and findings management
Cobalt · Credit-based subscription
Continuous attack surface management and offensive security platform combining automated scanning with expert-led pentesting
Bishop Fox · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Unknown Vulnerabilities Persist Due to No Penetration Testing
ConfidentialityCritical exploitable vulnerabilities in the enterprise's network, applications, and services remain undiscovered because no penetration testing program exists to proactively identify them before attackers do.
False Sense of Security from Automated Scanning Alone
IntegrityThe organization relies solely on automated vulnerability scanning, which misses complex attack chains and configuration weaknesses that only a structured penetration testing program would uncover.
Compliance Gap from Absent Penetration Testing Capability
IntegrityThe organization fails to meet regulatory or contractual requirements for penetration testing because no program with defined scope, frequency, and remediation processes has been established.
Vulnerabilities (When Safeguard Absent)
No Established Penetration Testing Program
Without a penetration testing program defining scope, frequency, methodology, and remediation processes, the organization has no proactive mechanism to discover exploitable vulnerabilities before attackers do.
No Defined Remediation Path for Penetration Test Findings
Absence of a program means that even ad hoc penetration tests produce findings with no defined process for routing, prioritizing, and tracking remediation of discovered vulnerabilities.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Record | Penetration test report and executive summary | Per engagement |
| Record | Remediation tracking and retest validation results | Post-engagement |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |