What it asks for. Organisations should test the effectiveness and resilience of their assets by finding and exploiting weaknesses in controls, processes and technology, simulating the objectives and actions of an attacker. It covers a defined programme, regular testing and remediation of findings.
In practice. A mature programme sets scope, frequency and rules of engagement, and combines external and internal tests, with application and social engineering testing where relevant. Tests are performed by qualified testers, findings are prioritised and remediated, and fixes are validated by retesting. Evidence includes the testing programme, reports, remediation tracking and retest results.
Common gaps. Tests are often narrowly scoped to satisfy a compliance requirement and repeated on the same targets each year. Findings may be accepted without remediation or retest, so the same issues recur.