The penetration testing methodology should be based on an industry-accepted approach such as which of the following?

The penetration testing methodology should be based on an industry-accepted approach such as which of the following?

• A. ISO 27001
• B. NIST SP800-115
• C. COBIT 5
• D. PCI-DSS v3.0

Answer: (B)

Structured, industry-accepted testing frameworks provide planning, execution, and reporting for penetration tests. NIST SP800-115 is a technical guide that explicitly defines how to conduct information security testing and assessment, outlining the full process from planning and establishing rules of engagement to choosing test methods, performing tests, gathering evidence, and delivering a structured remediation-focused report. This direct focus on the testing process, with guidance to keep testing controlled, repeatable, and auditable, makes it the best fit for a penetration testing methodology. Other standards serve different purposes. ISO 27001 centers on establishing and certifying an information security management system, not on how to conduct a test. COBIT 5 is about IT governance and management controls, not the step-by-step testing process. PCI-DSS v3.0 sets security requirements for cardholder data and references testing, but it does not prescribe a detailed penetration testing methodology.

Structured, industry-accepted testing frameworks provide planning, execution, and reporting for penetration tests. NIST SP800-115 is a technical guide that explicitly defines how to conduct information security testing and assessment, outlining the full process from planning and establishing rules of engagement to choosing test methods, performing tests, gathering evidence, and delivering a structured remediation-focused report. This direct focus on the testing process, with guidance to keep testing controlled, repeatable, and auditable, makes it the best fit for a penetration testing methodology.

Other standards serve different purposes. ISO 27001 centers on establishing and certifying an information security management system, not on how to conduct a test. COBIT 5 is about IT governance and management controls, not the step-by-step testing process. PCI-DSS v3.0 sets security requirements for cardholder data and references testing, but it does not prescribe a detailed penetration testing methodology.