What it asks for. Testers used for threat-led penetration testing must be of the highest suitability and reputability, have the technical and organisational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, and be certified by an accreditation body or adhere to formal codes of conduct or ethical frameworks.
In practice. Testers must provide an independent assurance or audit report on the sound management of risks associated with TLPT, including protection of confidential information and redress for business risks, and be covered by professional indemnity insurance, including against misconduct and negligence. Internal testers may be used only under conditions including competent authority approval, sufficient dedicated resources and avoidance of conflicts of interest, and the threat intelligence provider must be external. Where internal testers are used, external testers must be contracted every three tests, and significant credit institutions must use external testers only. Evidence includes due diligence files on testers and contracts.
Common gaps. Organisations often select testers on price, without verifying certification, insurance cover or conflicts of interest.