18.2: Perform Periodic External Penetration Tests
Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.
Asset Type |
Security Function |
Implementation Groups |
---|---|---|
Network |
Identify |
2, 3 |
Dependencies
Safeguard 18.1: Establish and Maintain a Penetration Testing Program
Inputs
GV54
: Most Recent External Penetration Report
Operations
Check Input 1
GV54
for date of most recent external penetration test. Compare date to current date and capture timeframe in months (M1)
Measures
M1 = Timeframe since last external penetration test
Metrics
If M1 is greater than twelve months, then this safeguard is measured at a 0 and receives a failing score. The other metrics don’t apply.