Pentest and vulnerability assessment
Testing coverage is a performance measure for assurance.
What the published 2016 guidance says
Testing coverage is a performance measure for assurance. The construct counts critical systems tested since their last major release against all critical systems, as a percentage. Illustrative bands are green at 100, orange at 75 or more and red below 75, with the target set at orange because a perfect green would be unrealistic. Evidence is the test report compared with the asset inventory. It is collected yearly. The risk owner owns it, a qualified tester collects, and the security lead is the client. A pie chart shows the position and a line chart the trend.
What it means in practice
Testing coverage is a performance measure for assurance. Count critical systems tested since their last major release against all critical systems. A 100 percent target can be unrealistic, which is why the example sets the target at orange rather than green.
Status of this record. For B.29, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the critical system list and the test reports. Count the systems tested since their last major release. Report the coverage and the trend. Record the exception and the risk acceptance for any system not tested.
Evidence an assessor asks for
- Vulnerability managementAsset inventory flagging critical systems and their last major release
- Technical compliancePenetration test and vulnerability assessment reports per system
The question an assessor will ask
An assessor will ask for asset inventory flagging critical systems and their last major release. The test for B.29 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Major releases not recorded, so tests cannot be tied to them
- Tests run on non-critical systems while critical ones go untested
Before the next review
Before the next review, test this against one live record: major releases not recorded, so tests cannot be tied to them.
What to check when the revision publishes
When DIS 27004 is published, compare the B.29 Pentest and vulnerability assessment record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.