FFIEC IT Examination Handbook IS-IV.A.2(b): IV.A.2(b) Penetration Tests (Information Security)

What does IS-IV.A.2(b) require?

Management subjects systems and users to penetration tests that mimic a threat source's search for and exploitation of vulnerabilities across network, client-side, web application and social engineering types, chooses the level and types for effective coverage, sets frequency and scope by the assurance the risk assessment requires, and determines the independence required of the testers whether internal or third party.