Discussion
Open question
- Posts
A one-page letter may say a test was done without showing whether important risks remain. What should the buyer ask?
Accepted answerCheck who tested, when they tested, which systems and interfaces were in scope, which methods were used, what was excluded, how findings were rated, and whether critical and high findings were retested after remediation. Protect sensitive details, but require enough evidence to understand residual risk and planned fixes. A test does not replace secure development or continuous vulnerability management. NIST SP 800-218 describes secure software development practices.
Community replyHow recent should remediation evidence be if the original penetration test is almost a year old?
- You must be logged in to reply to this topic.