Crossfoot
Crossfoot / Controls / Penetration testing and independent assessment
Draft v0.1.06 of 6 frameworks

Penetration testing and independent assessment

Periodic penetration tests and independent assessments of control effectiveness.

Where it appears

SOC 2
CC4.1Selects, develops and performs ongoing and/or separate evaluations
CC7.1Detection and monitoring procedures
PCI DSS 4.0
11.4External and internal penetration testing is regularly performed
NIST CSF 2.0
ID.IMImprovement (incl. ID.IM-02, improvements from tests and exercises)
ISO 27001:2022
A.8.29Security testing in development and acceptance
A.5.35Independent review of information security
HIPAA Security Rule
164.308(a)(8)Evaluation
NIST 800-53 r5
CA-8Penetration testing
CA-2Control assessments

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Most recent internal and external penetration test reports
  • Pen test methodology and tester qualifications
  • Remediation tracking for findings, with retest evidence
  • Segmentation test results where segmentation reduces scope

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0