Penetration Testing Standards · PEN
Overview
These standards define how penetration tests must be planned, approved, executed and reported to minimise risk to live systems and ensure actionable outcomes.
The scope of the penetration test must be defined clearly in advance · PEN-01 · MUST · DEV/TEST
Define the scope explicitly before testing begins, specifying systems, applications, and components to be tested.
Recognised scope types include:
- External Network Testing
- Internal Network Testing
- Web Application Testing
- API Testing
- Cloud Infrastructure Testing
- Social Engineering (only if explicitly agreed)
The penetration test must have formal sign-off from the System Owner and Relevant Stakeholders before it begins · PEN-02 · MUST · DEV/TEST
An agreed contract or Statement of Work (SoW) from the testing provider must be in place and cover: scope, methodology, test windows, escalation paths, impact management, and legal statements.
Testing should be performed on a representative environment · PEN-03 · SHOULD · DEV/TEST
Prefer a non‑production environment that mirrors production configuration (e.g. Azure Front Door, Web Application Firewall). Avoid testing in production unless absolutely necessary and explicitly approved.
System access to conduct the penetration test must be controlled and monitored · PEN-04 · MUST · DEV/TEST
Grant the least privilege required for the duration of testing. Access must be time‑bound and revoked immediately after testing concludes. Maintain audit logs of access and tester activity, and rotate any credentials or tokens post‑test.
Penetration testers must not have access to production data · PEN-05 · MUST · DEV/TEST
Do not provide testers with access to live production data. If production must be used, ensure no production data is present, or anonymise sensitive data to an acceptable standard. After testing, reset or roll back changes and revoke access.
Penetration testers must provide a formal report of findings and remediation recommendations · PEN-06 · MUST · DEV/TEST
Require a formal report including scope and methodology, evidence of findings with severity ratings, impacted assets, reproducible steps, and clear remediation recommendations.