Free one-page control map

One Penetration Test, Mapped to the Controls You Are Audited On

Pen test evidence built for your auditor's review: mapped in one report, retest included.

This one-page map shows where the evidence from a penetration test fits the controls a bank or payment business is audited on. Use it to agree the scope with your security team before testing, and to point your auditor to the right part of the report afterwards.

What the map covers

• PCI DSS v4.0.1, requirements 11.4.1 to 11.4.5: a documented testing methodology, internal and external testing, correcting exploitable findings and testing again to verify the fixes, and segmentation testing where segmentation is used.
• ISO/IEC 27001:2022, Annex A 8.8 and 8.29: management of technical vulnerabilities, and security testing in development and acceptance.
• SOC 2, CC4.1: penetration testing as one of the example separate evaluations of your controls.
• NIST CSF 2.0: where test results support the framework's six Functions.
• Regional rows: the MAS Technology Risk Management Guidelines (Singapore) and APRA CPS 234 (Australia).

One report, three readers

• Leadership summary: the business risk in plain language for your board and executives.
• Engineer detail: how each finding was found and how to fix it.
• Control mapping for auditors: findings mapped to ISO/IEC 27001:2022, SOC 2, PCI DSS 4.0, OWASP ASVS and your regulator's rules.

Snipeyes is a CREST Member and certified to ISO/IEC 27001:2022. We perform the test and map the evidence. Your auditor or assessor makes the compliance decision.