FFIEC IT Examination Handbook IS-IV.A.1: IV.A.1 Key Testing Factors (Information Security)

What does IS-IV.A.1 require?

Management designs independent tests with a scope sufficient in aggregate to validate that the security process identifies and controls information security risk, reviews the qualifications of testing personnel, decides whom to notify of the tests, controls the tests to limit risk to confidentiality, integrity and availability with safeguards for customer information uncovered, background checks and bonding for testers, logs of testing actions, and limited distribution of test plans and data, and applies the further factors the booklet lists.