Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p8
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 8/21)
Character Range: 51451–54518

Part 3.3—Systems testing

Division 1—Penetration testing

3.8  Penetration testing requirements
 (1) Penetration testing must evaluate the effectiveness of the implementation of security controls in the information technology system through which the accredited entity provides, or will provide, its accredited services by emulating the tools and techniques of likely attackers to exploit security weaknesses.
 (2) Penetration testing must include:
 (a) testing of egress and ingress points of the information technology system;
 (b) non-authenticated penetration testing (also known as black‑box testing); and
 (c) authenticated penetration testing (also known as white‑box testing).
 (3) If an accredited entity uses the infrastructure of a cloud service provider as part of its information technology system within its DI data environment, the penetration testing required by subrule (2) must be conducted only on that part of the entity's information technology system that is hosted by, or part of the tenancy with, the cloud service provider (cloud service provider's infrastructure).
 (4) However, if an accredited entity's arrangement with a cloud service provider does not allow penetration testing by the entity of the cloud service provider's infrastructure:
 (a) the entity must ensure the cloud service provider has conducted the kinds of penetration testing referred to in subrule (2) on that infrastructure at least once in each of the accredited entity's reporting periods; and
 (b) the requirements in rules 3.9 and 3.10 do not apply to penetration testing conducted by the cloud service provider.
 (5) The penetration testing by the accredited entity's assessor must be conducted before the protective security assessment.

Applicants
 (6) If subrule (4) applies to an applicant because of rule 2.3, the words 'at least once in each of the accredited entity's reporting periods' appearing in paragraph 4(a) are to be ignored.

3.9  Penetration testing assessor
  Penetration testing must be conducted by an assessor who meets the following additional requirements:
 (a) be external to the accredited entity and, if the entity is part of a corporate group, external to the group; and
 (b) not be, or have been, involved in the design, implementation, operation or management of the accredited entity's DI data environment or accredited services.

3.10  Penetration testing report
  An assessor that has completed penetration testing for an accredited entity must prepare a report of that testing that includes:
 (a) a description of the tools and processes used to conduct the penetration testing;
 (b) a description of the scope of the penetration testing; and
 (c) the results of the penetration testing, including:
 (i) identification of any security risks or vulnerabilities in the accredited entity's DI data environment, including in its information technology system when in operation;
 (ii) any other findings; and
 (iii) any recommendations.

Division 2—Useability testing

3.11  Accessible and inclusive services
  This Division applies for