CINXE.COM

<!DOCTYPE html> <html class="client-nojs" lang="en" dir="ltr"> <head> <meta charset="UTF-8"/> <title>FAQ - The Penetration Testing Execution Standard</title> <script>document.documentElement.className="client-js";RLCONF={"wgBreakFrames":!1,"wgSeparatorTransformTable":["",""],"wgDigitTransformTable":["",""],"wgDefaultDateFormat":"dmy","wgMonthNames":["","January","February","March","April","May","June","July","August","September","October","November","December"],"wgRequestId":"4998d3ece743b50fb3e825cc","wgCSPNonce":!1,"wgCanonicalNamespace":"","wgCanonicalSpecialPageName":!1,"wgNamespaceNumber":0,"wgPageName":"FAQ","wgTitle":"FAQ","wgCurRevisionId":958,"wgRevisionId":958,"wgArticleId":3,"wgIsArticle":!0,"wgIsRedirect":!1,"wgAction":"view","wgUserName":null,"wgUserGroups":["*"],"wgCategories":[],"wgPageContentLanguage":"en","wgPageContentModel":"wikitext","wgRelevantPageName":"FAQ","wgRelevantArticleId":3,"wgIsProbablyEditable":!1,"wgRelevantPageIsProbablyEditable":!1,"wgRestrictionEdit":["sysop"],"wgRestrictionMove":["sysop"]};RLSTATE={"site.styles":"ready","noscript":"ready","user.styles":"ready","user":"ready","user.options": "loading","skins.vector.styles.legacy":"ready"};RLPAGEMODULES=["site","mediawiki.page.ready","mediawiki.toc","skins.vector.legacy.js"];</script> <script>(RLQ=window.RLQ||[]).push(function(){mw.loader.implement("user.options@1hzgi",function($,jQuery,require,module){/*@nomin*/mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"}); });});</script> <link rel="stylesheet" href="/load.php?lang=en&modules=skins.vector.styles.legacy&only=styles&skin=vector"/> <script async="" src="/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector"></script> <meta name="ResourceLoaderDynamicStyles" content=""/> <link rel="stylesheet" href="/load.php?lang=en&modules=site.styles&only=styles&skin=vector"/> <meta name="generator" content="MediaWiki 1.36.2"/> <link rel="shortcut icon" href="/favicon.ico"/> <link rel="search" type="application/opensearchdescription+xml" href="/opensearch_desc.php" title="The Penetration Testing Execution Standard (en)"/> <link rel="EditURI" type="application/rsd+xml" href="http://www.pentest-standard.org/api.php?action=rsd"/> <link rel="license" href="http://www.gnu.org/licenses/old-licenses/fdl-1.2.txt"/> <link rel="alternate" type="application/atom+xml" title="The Penetration Testing Execution Standard Atom feed" href="/index.php?title=Special:RecentChanges&feed=atom"/> </head> <body class="mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-FAQ rootpage-FAQ skin-vector action-view skin-vector-legacy"><div id="mw-page-base" class="noprint"></div> <div id="mw-head-base" class="noprint"></div> <div id="content" class="mw-body" role="main"> <a id="top"></a> <div id="siteNotice" class="mw-body-content"></div> <div class="mw-indicators mw-body-content"> </div> <h1 id="firstHeading" class="firstHeading" >FAQ</h1> <div id="bodyContent" class="mw-body-content"> <div id="siteSub" class="noprint">From The Penetration Testing Execution Standard</div> <div id="contentSub"></div> <div id="contentSub2"></div> <div id="jump-to-nav"></div> <a class="mw-jump-link" href="#mw-head">Jump to navigation</a> <a class="mw-jump-link" href="#searchInput">Jump to search</a> <div id="mw-content-text" lang="en" dir="ltr" class="mw-content-ltr"><div class="mw-parser-output"><div id="toc" class="toc" role="navigation" aria-labelledby="mw-toc-heading"><input type="checkbox" role="button" id="toctogglecheckbox" class="toctogglecheckbox" style="display:none" /><div class="toctitle" lang="en" dir="ltr"><h2 id="mw-toc-heading">Contents</h2><span class="toctogglespan"><label class="toctogglelabel" for="toctogglecheckbox"></label></span></div> <ul> <li class="toclevel-1 tocsection-1"><a href="#Penetration_Testing_Execution_Standard_-_the_FAQ"><span class="tocnumber">1</span> <span class="toctext">Penetration Testing Execution Standard - the FAQ</span></a> <ul> <li class="toclevel-2 tocsection-2"><a href="#Q:_What_is_this_.22Penetration_Testing_Execution_Standard.22.3F"><span class="tocnumber">1.1</span> <span class="toctext"><b>Q</b>: What is this "Penetration Testing Execution Standard"?</span></a></li> <li class="toclevel-2 tocsection-3"><a href="#Q:_Who_is_involved_with_this_standard.3F"><span class="tocnumber">1.2</span> <span class="toctext"><b>Q</b>: Who is involved with this standard?</span></a></li> <li class="toclevel-2 tocsection-4"><a href="#Q:_So_is_this_a_closed_group_or_can_I_join_in.3F"><span class="tocnumber">1.3</span> <span class="toctext"><b>Q</b>: So is this a closed group or can I join in?</span></a></li> <li class="toclevel-2 tocsection-5"><a href="#Q:_Is_this_going_to_be_a_formal_standard.3F"><span class="tocnumber">1.4</span> <span class="toctext"><b>Q</b>: Is this going to be a formal standard?</span></a></li> <li class="toclevel-2 tocsection-6"><a href="#Q:_Is_the_standard_going_to_include_all_possible_pentest_scenarios.3F"><span class="tocnumber">1.5</span> <span class="toctext"><b>Q</b>: Is the standard going to include all possible pentest scenarios?</span></a></li> <li class="toclevel-2 tocsection-7"><a href="#Q:_Is_this_effort_going_to_standardize_the_reporting_as_well.3F"><span class="tocnumber">1.6</span> <span class="toctext"><b>Q</b>: Is this effort going to standardize the reporting as well?</span></a></li> <li class="toclevel-2 tocsection-8"><a href="#Q:_Who_is_the_intended_audience_for_this_standard.2Fproject.3F"><span class="tocnumber">1.7</span> <span class="toctext"><b>Q</b>: Who is the intended audience for this standard/project?</span></a></li> <li class="toclevel-2 tocsection-9"><a href="#Q:_Is_there_a_mindmap_version_of_the_original_sections.3F"><span class="tocnumber">1.8</span> <span class="toctext"><b>Q</b>: Is there a mindmap version of the original sections?</span></a></li> </ul> </li> </ul> </div> <h2><span class="mw-headline" id="Penetration_Testing_Execution_Standard_-_the_FAQ">Penetration Testing Execution Standard - the FAQ</span></h2> <h4><span id="Q:_What_is_this_"Penetration_Testing_Execution_Standard"?"></span><span class="mw-headline" id="Q:_What_is_this_.22Penetration_Testing_Execution_Standard.22.3F"><b>Q</b>: What is this "Penetration Testing Execution Standard"?</span></h4> <p><b>A</b>: It is a new standard designed to provide both businesses and security service providers with a common language and scope for performing penetration testing (i.e. Security evaluations). It started early in 2009 following a discussion that sparked between some of the founding members over the value (or lack of) of penetration testing in the industry. </p> <h4><span id="Q:_Who_is_involved_with_this_standard?"></span><span class="mw-headline" id="Q:_Who_is_involved_with_this_standard.3F"><b>Q</b>: Who is involved with this standard?</span></h4> <p><b>A</b>: We are a group of information security practitioners from all areas of the industry (I.e. Financial Institutions, Service Providers, Security Vendors). The group currently consists of: </p> <ul><li><a rel="nofollow" class="external text" href="http://twitter.com/indi303">Chris Nickerson</a>, CEO - <a rel="nofollow" class="external text" href="http://www.lares.com">Lares Consulting</a>.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/hackingdave">Dave Kennedy</a>, CEO - <a rel="nofollow" class="external text" href="https://www.trustedsec.com/blog/">blog</a> <a rel="nofollow" class="external text" href="https://www.trustedsec.com/">TrustedSec</a> .</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/chrisjohnriley">Chris John Riley</a>, IT Security Analyst - <a rel="nofollow" class="external text" href="http://blog.c22.cc">blog</a> Raiffeisen Informatik GmbH.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/infosecmafia">Eric Smith</a>, Partner - <a rel="nofollow" class="external text" href="http://www.lares.com">Lares Consulting</a>.</li> <li><a href="/index.php/User:Iamit" title="User:Iamit">Iftach Ian Amit</a>, Director of Services - <a rel="nofollow" class="external text" href="http://www.iamit.org/blog">blog</a> <a rel="nofollow" class="external text" href="http://www.ioactive.com">IOActive</a>.</li> <li><a rel="nofollow" class="external text" href="http://www.pentest-standard.org/index.php?title=User:drew">Andrew Rabie</a>, Wizard - <a rel="nofollow" class="external text" href="http://www.avon.com/">Avon Products Inc</a>.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/stfn42">Stefan Friedli</a>, Senior Security Consultant - <a rel="nofollow" class="external text" href="http://www.scip.ch">scip AG</a>.</li> <li><a href="/index.php?title=User:Meeas&action=edit&redlink=1" class="new" title="User:Meeas (page does not exist)">Justin Searle</a>, Senior Security Analyst - <a rel="nofollow" class="external text" href="http://www.inguardians.com">InGuardians</a>.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/kaospunk">Brandon Knight</a>, Senior Security Consultant.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/carnal0wnage">Chris Gates</a>, Senior Security Consultant - <a rel="nofollow" class="external text" href="http://carnal0wnage.attackresearch.com/">blog</a> <a rel="nofollow" class="external text" href="http://www.lares.com">Lares Consulting</a>.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/j0emccray">Joe McCray</a>, CEO - Strategic Security.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/Carlos_Perez">Carlos Perez</a>, Lead Vulnerability Research Engineer - Tenable Security.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/strandjs">John Strand</a>, Owner - Black Hills Information Security.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/steve_tornio">Steve Tornio</a>, Senior Consultant - Sunera LLC.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/c7five">Nick Percoco</a>, Senior Vice President - SpiderLabs at Trustwave.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/daveshackleford">Dave Shackelford</a>, Security Consultant, SANS Instructor.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/attackresearch">Val Smith</a> - Attack Research.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/digininja">Robin Wood</a>, Senior Security Engineer - <a rel="nofollow" class="external text" href="http://www.digininja.org/">blog</a> <a rel="nofollow" class="external text" href="http://www.randomstorm.com">RandomStorm</a>.</li> <li><a rel="nofollow" class="external text" href="http://twitter.com/wimremes">Wim Remes</a>, Security Consultant - Belgium.</li></ul> <h4><span id="Q:_So_is_this_a_closed_group_or_can_I_join_in?"></span><span class="mw-headline" id="Q:_So_is_this_a_closed_group_or_can_I_join_in.3F"><b>Q</b>: So is this a closed group or can I join in?</span></h4> <p><b>A</b>: We started this with about 6 people, the first in-person meeting held almost 20. We would love more insight and down-to-earth opinions so if you can contribute please feel free to email us. </p> <h4><span id="Q:_Is_this_going_to_be_a_formal_standard?"></span><span class="mw-headline" id="Q:_Is_this_going_to_be_a_formal_standard.3F"><b>Q</b>: Is this going to be a formal standard?</span></h4> <p><b>A</b>: We are aiming to create an actual standard so that businesses can have a baseline of what is needed when they get a pentest as well as an understanding of what type of testing they require or would provide value to their business. The lack of standardization now is only hurting the industry as businesses are getting low-quality work done, and practitioners lack guidance in terms of what is needed to provide quality service. </p> <h4><span id="Q:_Is_the_standard_going_to_include_all_possible_pentest_scenarios?"></span><span class="mw-headline" id="Q:_Is_the_standard_going_to_include_all_possible_pentest_scenarios.3F"><b>Q</b>: Is the standard going to include all possible pentest scenarios?</span></h4> <p><b>A</b>: While we can't possibly cover all scenarios, the standard is going to define a baseline for the minimum that is required from a basic pentest, as well as several "levels" on top of it that provide more comprehensive activities required for organizations with higher security needs. The different levels would also be defined as per the industry in which they should be the baseline for. </p> <h4><span id="Q:_Is_this_effort_going_to_standardize_the_reporting_as_well?"></span><span class="mw-headline" id="Q:_Is_this_effort_going_to_standardize_the_reporting_as_well.3F"><b>Q</b>: Is this effort going to standardize the reporting as well?</span></h4> <p><b>A</b>: Yes. We feel that providing a standard for the test without defining how the report is provided would be useless. We will define both executive (business) reporting as well as technical reporting as an integrated part of the standard. </p> <h4><span id="Q:_Who_is_the_intended_audience_for_this_standard/project?"></span><span class="mw-headline" id="Q:_Who_is_the_intended_audience_for_this_standard.2Fproject.3F"><b>Q</b>: Who is the intended audience for this standard/project?</span></h4> <p><b>A</b>: Two main communities: businesses that require the service, and service providers. For businesses the goal is to enable them to demand a specific baseline of work as part of a pentest. For service providers the goal is to provide a baseline for the kinds of activities needed, what should be taken into account as part of the pentest from scoping through reporting and deliverables. </p> <h4><span id="Q:_Is_there_a_mindmap_version_of_the_original_sections?"></span><span class="mw-headline" id="Q:_Is_there_a_mindmap_version_of_the_original_sections.3F"><b>Q</b>: Is there a mindmap version of the original sections?</span></h4> <p><b>A</b>: Following popular demand, we have _a_ version of the mindmap used when creating the first drafts of the standard available for download <a rel="nofollow" class="external text" href="http://iamit.org/docs/Penetration_Testing_Execution_Standard.mm">here</a> (in FreeMind format). </p>    </div> <div class="printfooter">Retrieved from "<a dir="ltr" href="http://www.pentest-standard.org/index.php?title=FAQ&oldid=958">http://www.pentest-standard.org/index.php?title=FAQ&oldid=958</a>"</div></div> <div id="catlinks" class="catlinks catlinks-allhidden" data-mw="interface"></div> </div> </div> <div id="mw-navigation"> <h2>Navigation menu</h2> <div id="mw-head">  <nav id="p-personal" class="mw-portlet mw-portlet-personal vector-menu" aria-labelledby="p-personal-label" role="navigation" > <h3 id="p-personal-label" class="vector-menu-heading"> <span>Personal tools</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"><li id="pt-login"><a href="/index.php?title=Special:UserLogin&returnto=FAQ" title="You are encouraged to log in; however, it is not mandatory [o]" accesskey="o">Log in</a></li></ul> </div> </nav> <div id="left-navigation">  <nav id="p-namespaces" class="mw-portlet mw-portlet-namespaces vector-menu vector-menu-tabs" aria-labelledby="p-namespaces-label" role="navigation" > <h3 id="p-namespaces-label" class="vector-menu-heading"> <span>Namespaces</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"><li id="ca-nstab-main" class="selected"><a href="/index.php/FAQ" title="View the content page [c]" accesskey="c">Page</a></li><li id="ca-talk" class="new"><a href="/index.php?title=Talk:FAQ&action=edit&redlink=1" rel="discussion" title="Discussion about the content page (page does not exist) [t]" accesskey="t">Discussion</a></li></ul> </div> </nav>  <nav id="p-variants" class="mw-portlet mw-portlet-variants emptyPortlet vector-menu vector-menu-dropdown" aria-labelledby="p-variants-label" role="navigation" > <input type="checkbox" class="vector-menu-checkbox" aria-labelledby="p-variants-label" /> <h3 id="p-variants-label" class="vector-menu-heading"> <span>Variants</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"></ul> </div> </nav> </div> <div id="right-navigation">  <nav id="p-views" class="mw-portlet mw-portlet-views vector-menu vector-menu-tabs" aria-labelledby="p-views-label" role="navigation" > <h3 id="p-views-label" class="vector-menu-heading"> <span>Views</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"><li id="ca-view" class="selected"><a href="/index.php/FAQ">Read</a></li><li id="ca-viewsource"><a href="/index.php?title=FAQ&action=edit" title="This page is protected.
You can view its source [e]" accesskey="e">View source</a></li><li id="ca-history"><a href="/index.php?title=FAQ&action=history" title="Past revisions of this page [h]" accesskey="h">View history</a></li></ul> </div> </nav>  <nav id="p-cactions" class="mw-portlet mw-portlet-cactions emptyPortlet vector-menu vector-menu-dropdown" aria-labelledby="p-cactions-label" role="navigation" > <input type="checkbox" class="vector-menu-checkbox" aria-labelledby="p-cactions-label" /> <h3 id="p-cactions-label" class="vector-menu-heading"> <span>More</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"></ul> </div> </nav> <div id="p-search" role="search" > <h3 > <label for="searchInput">Search</label> </h3> <form action="/index.php" id="searchform"> <div id="simpleSearch" data-search-loc="header-navigation"> <input type="search" name="search" placeholder="Search The Penetration Testing Execution Standard" autocapitalize="sentences" title="Search The Penetration Testing Execution Standard [f]" accesskey="f" id="searchInput"/> <input type="hidden" name="title" value="Special:Search"/> <input type="submit" name="fulltext" value="Search" title="Search the pages for this text" id="mw-searchButton" class="searchButton mw-fallbackSearchButton"/> <input type="submit" name="go" value="Go" title="Go to a page with this exact name if it exists" id="searchButton" class="searchButton"/> </div> </form> </div> </div> </div> <div id="mw-panel"> <div id="p-logo" role="banner"> <a class="mw-wiki-logo" href="/index.php/Main_Page" title="Visit the main page"></a> </div>  <nav id="p-navigation" class="mw-portlet mw-portlet-navigation vector-menu vector-menu-portal portal" aria-labelledby="p-navigation-label" role="navigation" > <h3 id="p-navigation-label" class="vector-menu-heading"> <span>Navigation</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"><li id="n-mainpage-description"><a href="/index.php/Main_Page" title="Visit the main page [z]" accesskey="z">Main page</a></li><li id="n-PTES-Technical-Guideline"><a href="/index.php/PTES_Technical_Guidelines">PTES Technical Guideline</a></li><li id="n-In-the-Media"><a href="/index.php/Media">In the Media</a></li><li id="n-FAQ"><a href="/index.php/FAQ">FAQ</a></li></ul> </div> </nav>  <nav id="p-tb" class="mw-portlet mw-portlet-tb vector-menu vector-menu-portal portal" aria-labelledby="p-tb-label" role="navigation" > <h3 id="p-tb-label" class="vector-menu-heading"> <span>Tools</span> </h3> <div class="vector-menu-content"> <ul class="vector-menu-content-list"><li id="t-whatlinkshere"><a href="/index.php/Special:WhatLinksHere/FAQ" title="A list of all wiki pages that link here [j]" accesskey="j">What links here</a></li><li id="t-recentchangeslinked"><a href="/index.php/Special:RecentChangesLinked/FAQ" rel="nofollow" title="Recent changes in pages linked from this page [k]" accesskey="k">Related changes</a></li><li id="t-specialpages"><a href="/index.php/Special:SpecialPages" title="A list of all special pages [q]" accesskey="q">Special pages</a></li><li id="t-print"><a href="javascript:print();" rel="alternate" title="Printable version of this page [p]" accesskey="p">Printable version</a></li><li id="t-permalink"><a href="/index.php?title=FAQ&oldid=958" title="Permanent link to this revision of the page">Permanent link</a></li><li id="t-info"><a href="/index.php?title=FAQ&action=info" title="More information about this page">Page information</a></li></ul> </div> </nav> </div> </div> <footer id="footer" class="mw-footer" role="contentinfo" > <ul id="footer-info" > <li id="footer-info-lastmod"> This page was last edited on 14 January 2017, at 15:30.</li> <li id="footer-info-copyright">Content is available under <a class="external" rel="nofollow" href="http://www.gnu.org/licenses/old-licenses/fdl-1.2.txt">GNU Free Documentation License 1.2</a> unless otherwise noted.</li> </ul> <ul id="footer-places" > <li id="footer-places-privacy"><a href="/index.php/The_Penetration_Testing_Execution_Standard:Privacy_policy" title="The Penetration Testing Execution Standard:Privacy policy">Privacy policy</a></li> <li id="footer-places-about"><a href="/index.php/The_Penetration_Testing_Execution_Standard:About" title="The Penetration Testing Execution Standard:About">About The Penetration Testing Execution Standard</a></li> <li id="footer-places-disclaimer"><a href="/index.php/The_Penetration_Testing_Execution_Standard:General_disclaimer" title="The Penetration Testing Execution Standard:General disclaimer">Disclaimers</a></li> </ul> <ul id="footer-icons" class="noprint"> <li id="footer-copyrightico"><a href="http://www.gnu.org/licenses/old-licenses/fdl-1.2.txt"><img src="/resources/assets/licenses/gnu-fdl.png" alt="GNU Free Documentation License 1.2" width="88" height="31" loading="lazy"/></a></li> <li id="footer-poweredbyico"><a href="https://www.mediawiki.org/"><img src="/resources/assets/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki" srcset="/resources/assets/poweredby_mediawiki_132x47.png 1.5x, /resources/assets/poweredby_mediawiki_176x62.png 2x" width="88" height="31" loading="lazy"/></a></li> </ul> </footer> <script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgPageParseReport":{"limitreport":{"cputime":"0.019","walltime":"0.022","ppvisitednodes":{"value":28,"limit":1000000},"postexpandincludesize":{"value":0,"limit":2097152},"templateargumentsize":{"value":0,"limit":2097152},"expansiondepth":{"value":2,"limit":40},"expensivefunctioncount":{"value":0,"limit":100},"unstrip-depth":{"value":0,"limit":20},"unstrip-size":{"value":0,"limit":5000000},"timingprofile":["100.00% 0.000 1 -total"]},"cachereport":{"timestamp":"20241123083057","ttl":86400,"transientcontent":false}}});mw.config.set({"wgBackendResponseTime":125});});</script> </body></html>