The canon · Security · SEC-3.1

Provide evidence of penetration testing performed within the last twelve months.

This is one of the twenty-five questions a carrier reviewer sends a vendor, in the words an examiner uses. Below it: the answers that make a reviewer stop on this item, derived by running Vaulith's rules engine on an estate that gets everything wrong, and the free questions that reach it.

What stops a reviewer here

One finding reaches this item.

Will escalateR-PEN-TEST · blocks this item

No penetration test is on record

There is no penetration test on record, or you have not said when the last one was. Section 500.5 has the carrier test its own systems at least annually, by a qualified internal or external party, and the questionnaire asks a vendor for evidence of the same from the last twelve months. A reviewer does not accept a description of the programme in place of the report; they ask for the report, and its date is the first thing they read.

To fix: Commission a penetration test by a qualified party, internal or external, that is independent of the team that built the systems; keep the report as an evidence record and attach it here. The report can be redacted; the date, the scope and the summary of findings cannot be.

How it is scored

Credit per verdict, times the weight.

A standard item carries weight 2. A pass earns 1.00 of it, a questioned answer 0.60, an escalated one 0.20 and a stop 0.00. An unanswered item earns nothing and still takes the citation penalty, so a profile cannot be improved by leaving an inconvenient question blank. The whole arithmetic is shown on the homepage and in every assessment.