Every job ends with a signed confession.
Auditors, insurers and big customers want to know who tested, when, and what you did about it. Year-round testing answers all three, signed by an independent certified tester.
Why reports get sent back.
Auditors check three things before they read a single finding.
Who did it
A CREST accredited, ISO 27001 certified company. Nobody on your IT team signs their own homework.
When it was done
A report from eleven months ago fails the “after significant change” test. This is where most reports get sent back.
Whether anyone can read it
A summary your board understands and detail your engineers can act on, in one report.
What each framework asks for.
If yours isn’t here, ask us.
- PCI DSS v4.0.1
- SOC 2
- HIPAA
- FTC Safeguards Rule
- CMMC 2.0
- NYDFS Part 500
- ISO/IEC 27001
- Cyber insurance
Requirement 11.4
PCI DSS v4.0.1
Internal and external testing yearly and after significant changes, by a qualified, independent tester.
Covers the after-change part most businesses miss, with the independence statement your QSA looks for.
Type II evidence
SOC 2
Penetration test evidence across the whole audit period.
Tests, findings, fixes and retests for the whole year, in the shape your auditor asks for.
Security Rule
HIPAA
A proposed update would make a yearly penetration test mandatory. The final rule isn’t out yet.
Year-round testing already meets it, with the documentation to show it.
16 CFR 314.4
FTC Safeguards Rule
Covered financial institutions must run a penetration test every year.
Your annual test and every test after it, with a signed report to show for it.
Level 2
CMMC 2.0
Practices CA.L2-3.12.1 and RA.L2-3.11.2, verified by a C3PAO.
Testing scoped to your CUI enclave and mapped to NIST SP 800-171, with the evidence your assessor asks for.
Section 500.5
NYDFS Part 500
Penetration testing at least once a year by a qualified internal or external party.
An independent, certified tester and a signed report for your annual certification.
Control A.8.8
ISO/IEC 27001
Technical vulnerabilities identified and managed.
Continuous evidence from a company certified to ISO/IEC 27001:2022 itself.
At renewal
Cyber insurance
How often you test, who does it and what you did with the results.
A clear answer to all three at renewal.
What your auditor gets.
Ready to hand over: what was tested, when, by whom, what was found and when it was fixed.
- Signed report with an executive summary
- Scope letter and rules of engagement
- Tester qualification and independence statement
- Retest evidence for every fix
- Attestation letter for your auditor, insurer or customer
- Methodology mapped to your framework
WhatsExposed demonstrated a profound understanding of cyber security principles and methodologies. Their expertise in identifying vulnerabilities and potential exploits was instrumental in enhancing security posture for our customers.
Ian O’CallaghanSecurity Division Lead, PFH, a Ricoh companyWorth reading next
Evidence for the whole year.
Tell us your framework and your domain, and we’ll come back with what we found and a plan.