When people first enquire about ISO 27001, the information security management system, they often have lots of questions about the impact it may have on their organisation, both positive and negative.
One question that regularly comes up is:
Do I need to do a Penetration Test to meet the requirements of ISO 27001?
Surprisingly the answer is no. But let’s look at what the standard actually says and why you might still need to do a pen test.
Penetration Testing & ISO 27001
Penetration Testing is not mentioned anywhere within the requirements of ISO 27001:2013 but if you look at the supporting standard ISO 27002:2013 you can find a reference under A18.2.3 Technical compliance review.
A18.2.3 requires a more technical approach to reviewing information systems in line with the organisation’s policies, and a penetration test could satisfy this.
However, ISO 27002 is a code-of-practice and does not form part of the certification scheme, therefore it is not a mandatory requirement, so you may choose another way to address this.
The control also notes that pen tests should not be a replacement for risk assessments.
Alternatives to Penetration Testing
While pen testing brings many benefits to your organisation, it can also be quite costly, depending on the scope of your project.
There are also many approaches to testing which some call black-box, white-box or grey-box, which generally refers to where in the network the test is run from and how much background knowledge the test has. More about Pen Testing.
Some alternative ways to test your technical network controls might include a web based port scan, vulnerability assessment or even the audit tools already built into your security appliance.
Providing you record and analyse the results of these scans, taking any required action, they can provide a basic level of security.
Other Reasons to Pen Test
Aside from it generally being good practice and an excellent way to manage risks in your network, you may be required to conduct a pen test for other reasons.
Cyber Essentials Plus is a scheme designed by the UK Government and a requirement of many public sector contracts. An explicit requirement of cyber essentials plus is to conduct a penetration test.
Clients may also mandate regular pen tests of a software product, particularly where it is hosting their data.
Conclusion
There’s no doubt, if you can pen test your controls then you should, but don’t let that be a barrier to achieving ISO 27001, which has many more organisational controls which can mitigate risks from human factors through to legal compliance.
Talk to our ISO 27001 Consultants about implementing a comprehensive information security management system.
Our cyber security team can also help you establish a threat management programme which includes penetration testing from our expert partners.
Contact us to discuss your requirements.
The post Is a Penetration Test required for ISO 27001? appeared first on Assent Risk Management.
When people first enquire about ISO 27001, the information security management system, they often have lots of questions about the impact it may have on their organisation, both positive and negative. One question that regularly comes up is: Do I need to do a Penetration Test to meet the requirements of ISO 27001? Surprisingly the answer is no. But let’s look at what the standard actually says and why you might still need to do a pen test. Penetration Testing & ISO 27001 Penetration Testing is not mentioned anywhere within the requirements of ISO 27001:2013 but if you look at…
Is a Penetration Test required for ISO 27001?
Source: Assent.InfoSec