Standard
Penetration Testing and Red Team Standard
This standard defines the requirements for the organization's penetration testing and red team programme. It establishes the minimum scope, frequency, methodology, and reporting requirements for both internal vulnerability assessment and externally conducted penetration testing.
- Type
- Standard
- Version
- 1.0.14
- Date
- 2026-09-24
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material threat, framework, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Testing programme requirements
- 5. Rules of engagement
- 6. Reporting
- 7. Remediation timelines
- 8. Vendor selection and qualification
- 9. Programme tracking and continuous improvement
- 10. Framework alignment
Frameworks it maps to
Related documents
- Information Security Policysecurity
- Vulnerability Management Proceduresecurity
- Logging and Monitoring Standardsecurity
- Production Security Requirementsoperations
- Third-Party and Supply Chain Risk Standardrisk
Next
All Documents