A single annual test is out of date within weeks. A program spreads testing across the year, follows your release cycle and checks that fixes actually worked.
Findings are tracked to closure and retested, and reports are written for engineers and for auditors.
Why it matters
Recurring tests scheduled with your releases
Web, mobile, API, network and cloud scope
Retesting of fixed findings included
Findings tracker shared with your teams
Reports accepted by regulators and auditors
Who delivers each serviceSome managed services are delivered by a vetted delivery partner rather than by CISO Consulting's own team. Each service states who delivers it, and the proposal confirms the delivering party and the contract before you commit. Explore managed security
How the engagement runs
- 1PlanScope, rules of engagement and calendar
- 2TestRun each test in the agreed window
- 3FixTrack findings with your owners
- 4RetestConfirm closure and report
What you receive
- Annual testing calendar
- Test reports with remediation guidance
- Retest confirmations
- Quarterly findings and trend review
Packages
| Essential | AdvancedRecommended | Enterprise | |
|---|---|---|---|
| Tests a year | Two | Four | Eight |
| Scope | One application and the external network | Applications, APIs and network | Applications, APIs, network, cloud and mobile |
| Retesting | One round | Two rounds | Unlimited within the term |
| Reports | Technical | Technical and executive | Technical, executive and developer workshop |
| Review | Yearly | Quarterly | Monthly |
The exact scope and targets are confirmed in your proposal.
Questions
Who performs the tests?
Testers may be from our team or a vetted partner under our quality oversight. The proposal states who.
Is production tested?
Only with your written approval and agreed safeguards, within the rules of engagement.