Do you perform penetration testing?
A product security question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. [Firm] tested the product in [month and year]. All critical and high findings were fixed and retested. A summary is available on request from our trust center.
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- A penetration test summary or letter of attestation
- Evidence that findings were remediated
If you don't do this yet
Don't imply a test you haven't had. Say when one is booked, or describe the testing you do run, such as automated scanning, and let the reviewer decide.
Related questions
How do you manage vulnerabilities?A model answer, the evidence behind it, and what to say if you don't do it yet.Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.