Pen test engagement & cyber self-assessment
Ran VAPT procurement end to end, negotiated re-test scope and cross-border data limits, and completed a regulator cyber self-assessment.
The goal
A regulated organisation needed independent security testing and had to complete its regulator’s cyber self-assessment, while making sure no data was handled in ways the rules do not allow.
What I did
- Ran the VAPT procurement end to end. Managed the vulnerability assessment and penetration testing (VAPT) engagement, from approaching providers to agreeing the work.
- Negotiated the scope, including re-testing, so fixed issues are confirmed as fixed rather than assumed.
- Set cross-border data limits. Agreed how test data could be handled, so the engagement stayed within data-protection requirements.
- Completed the regulator’s cyber self-assessment and submitted it.
Outcome
The testing scope was agreed and the self-assessment was submitted.
What others can learn
- Always buy the re-test. A pen test report without a re-test only tells you what was broken, not that it is fixed now.
- Data rules apply to your testers too. Where test data goes and who can see it should be agreed before testing starts.
- Treat the self-assessment as a health check, not a form to fill in. The honest answers show you where to invest next.