[Priya Shah]

A one-page letter may say a test was done without showing whether important risks remain. What should the buyer ask?

[Marcus Reed]

Accepted answer

Check who tested, when they tested, which systems and interfaces were in scope, which methods were used, what was excluded, how findings were rated, and whether critical and high findings were retested after remediation. Protect sensitive details, but require enough evidence to understand residual risk and planned fixes. A test does not replace secure development or continuous vulnerability management. NIST SP 800-218 describes secure software development practices.

[Maya Chen]

Community reply

How recent should remediation evidence be if the original penetration test is almost a year old?

[Author]

Posts