PTES
Vulnerability Analysis

PTES PTESPHASE-4: Vulnerability Analysis

Per PTES Vulnerability Analysis phase: identify weaknesses. Requirements include (a) conduct vulnerability scanning + manual review + (b) validate findings + remove false positives + (c) prioritise by exploitability + impact + business context + (d) cross-reference threat intelligence + CVE + ATT&CK + (e) document validated vulnerabilities + (f) integrate with exploitation.

What else in your programme already covers this

This control maps to 76 controls across 37 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 29147:2018 · 4 controls

  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)
  • CPG-1.D Revoking Credentials for Departing Employees
  • CPG-5.A Vulnerability Disclosure Program
  • CPG-8.A Network Segmentation

ISO/IEC 27011:2024 · 3 controls

ISO/IEC 30111:2019 · 3 controls

ISO 27017 · 2 controls

ISO 27018 · 2 controls

ISO 27043 · 2 controls

ISO/SAE 21434 · 2 controls

NIST SP 800-190 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

OWASP SAMM · 2 controls

  • OWASPSAMM-4 Verification: Architecture Assessment, Requirements-Driven Testing, Security Testing
  • OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

South Korea ISMS-P · 2 controls

API 1164 · 1 control

BSI IT-Grundschutz · 1 control

  • BSI-14 Vulnerability scanning and management
  • FFIEC-06 Network security and segmentation

IEC 62443 · 1 control

ISO 27019 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 29134:2023 · 1 control

  • 29134-9.2 Report findings and recommendations

NIST SP 1800-32 · 1 control

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

PSD2 SCA · 1 control

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
  • UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights
  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 76 it maps to, and the evidence behind each claim, over MCP and REST.