{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:c28fb0e08623dc507cf60fcdf8730d6f0b13de3d95018f9692f7c72965a24317","slug":"controls-technical-security-testing-pentest","url":"/assets/agent_workflow-controls-technical-security-testing-pentest-c8238a47.ccc14cecb6d42275.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"assure"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-technical-security-testing-pentest","description":"Runs ON an existing Audit item (audit_type: it_audit) that represents the authorized penetration-test engagement — the workflow instance attaches to that record and enriches it (scope, ratings, dates, and the assurance conclusion write back to its fields); it never creates a duplicate engagement record. In scope: authorized technical testing (reconnaissance, discovery, exploitation validation, severity rating, reporting, and retest) of the defined system boundary against its control baseline and assessment objective, with each confirmed finding recorded as an Issue linked to the anchor Audit and its affected Controls. Out of scope: any testing beyond the agreed rules of engagement, and the downstream remediation program itself — confirmed control gaps and open POA&M findings are handed to the Security Control Assessment & POA&M Remediation workflow, and the assurance conclusion to the Cybersecurity Assurance Review workflow. No upstream workflow feeds this engagement; its inputs are the anchor Audit, the in-scope system boundary (Process items), the control baseline (Control items, framework nist-800-53), the assessment objective and signed authorization, and any open Issue items (source: penetration_test / vulnerability_scan) from prior engagements.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-technical-security-testing-pentest","capabilities":[],"controls":["UC-VULN-02","UC-SDLC-14","UC-SDLC-04","UC-CONFIG-04","UC-NET-01","UC-NET-02","UC-NET-03","UC-NET-04","UC-SDLC-05","UC-VULN-04","UC-VULN-07"],"domains":["controls"],"lineOfDefense":"assure","mappingStatus":"mapped","releaseId":"sha256:c28fb0e08623dc507cf60fcdf8730d6f0b13de3d95018f9692f7c72965a24317","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-technical-security-testing-pentest","standards":["nist-800-53"],"teams":["it"]},"id":"wf:C10","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC10","slug":"controls-technical-security-testing-pentest","sourceIds":["aiuc-1","cobit-2019","eu-ai-act","gdpr","iso-27001","nist-800-53","nist-ai-tevv-athlon","nist-csf-2","pci-dss","soc2"],"sourceUrl":null,"title":"Technical Security Testing & Pentest Engagement","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0958f175515960b2eff14c7c3c44cf5855dc4c7ea253ec951422a378ef993d65","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","targetId":"uc:UC-SDLC-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:36b34bdad817a44b1861e211a7e9586746683c2bae89309d2db34a7425bfd8b6","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-net-01-30bfdc5f.json","targetId":"uc:UC-NET-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:49d93e5d29de0c10f132b1916dd14d56d4b1e8db459ed4630beaf75483a914c6","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-net-02-6e84b235.json","targetId":"uc:UC-NET-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:837d75050ef7daf3f5cdeab8b49e77ac136232fece5402441b5dd9eff67b47f5","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-net-03-3b26b0a0.json","targetId":"uc:UC-NET-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:86c55221ccf682aacab5b8d62ced760182269ad9a12206c3172238e08ea63d02","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-config-04-ed033b30.json","targetId":"uc:UC-CONFIG-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:92e3daed9da1a425643798aca3ce35d0cda3bb22e93b6e992c7eae67274cda75","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-vuln-07-abfa5ce7.json","targetId":"uc:UC-VULN-07","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:98964559bf025c94d81c0fdd464402a6ec07151a97dd2f119659938a49109d2a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-vuln-02-8366666b.json","targetId":"uc:UC-VULN-02","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b338ba0af86a893a6a8e588b0ff6d758f3b90c68309ff44e50aaee0b873f9d4e","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-vuln-04-d07c87cf.json","targetId":"uc:UC-VULN-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c66b92cf49f1f5d5eed1e71adb152dcbe855ee8a8b1fbde477babbd7c46def7a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-sdlc-14-5c9b0e48.json","targetId":"uc:UC-SDLC-14","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eecbc007a8af48ce33def4f3af48ffc26e7ae19f42399e95702ebccd0ac394f1","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","targetId":"uc:UC-SDLC-05","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f59a81df5aef8a16fce8ab35d5f83ac965b3271ee53c3f648004f654951bceb8","properties":{},"sourceDetailPath":"/data/v1/records/wf-c10-29ff1ddb.json","sourceId":"wf:C10","targetDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","targetId":"uc:UC-NET-04","type":"tests"}],"schemaVersion":1}