Penetration Testing Program Management and Leadership
Penetration Testing Program Management and Leadership
This domain tests the shift from running tests to running a program. Leaders set governance, fund the capability, select and oversee providers, track remediation, and connect testing to risk management. The exam expects measurable, repeatable processes rather than ad hoc engagements.
Core rules
- Establish policy and governance: objectives, scope criteria, roles, approval authority, frequency, and escalation paths. Align with risk appetite and regulatory obligations.
- Tier testing by asset criticality and change: internet-facing and regulated systems more often; after major releases, mergers, or architecture changes. A calendar alone is not a program.
- Manage providers: define competence requirements, conflict-of-interest checks, NDAs, insurance, quality gates, and acceptance criteria. Retain oversight of scope and findings.
- Track remediation as a lifecycle: owner, due date, risk acceptance, retest, and closure. Report aging findings and repeat findings to management.
- Measure with a small set of metrics: coverage of critical assets, findings by severity and age, remediation closure rate, repeat findings, detection rate, and time to remediate.
- Build team capability and ethics: training, lab access, certification, peer review, code of conduct, and knowledge retention. Protect evidence and client data.
Worked example
A mid-size organization has 40 critical applications and one annual external test. The leader replaces the ad hoc test with a tiered program: Tier 1 internet-facing and regulated apps tested twice yearly and after major change; Tier 2 annually; Tier 3 on request. A vendor panel is qualified, scopes are standardized, and a remediation dashboard tracks findings to closure. The board receives coverage and closure-rate metrics. Reasoning: frequency follows risk and change, and the program measures whether risk actually falls.
Traps
Treating testing as a one-off purchase; buying tools instead of process; no remediation ownership; selecting vendors on price alone; reporting activity counts without outcomes; and ignoring detection and response.