SFS 9 / SF 0

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Have all in-scope applications undergone documented penetration testing by independent assessors during the review period, with verified remediation of critical findings?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented penetration test reports with remediation evidence for all critical findings

Assessment criterion and evidence

Actor: Organization's security team and independent assessors. Scope: All internet-facing applications and critical internal systems. Evidence period: The 12-month review period ending [current date]. Required evidence: Penetration test reports; Remediation verification records. Negative criterion: Absence of full-scope test reports or unremediated critical findings. Missing evidence: Pending until complete test documentation is provided

View the JSON record (opens in a new tab).

Assessment result: unset.