Penetration tests requirement removed from Operations Security but remains in Risk Management Policy

[Sean-Klein]

While reviewing your policies to see how you handled Vanta templates with the requirement for yearly penetrations tests, I noticed you removed this from the Operations Security Policy. Was it your intention to keep the yearly requirement for a penetration test in your Risk Management Policy? If this was an oversight, I wanted to draw your attention to it.

Risk Management Policy

Risks are assessed and ranked according to their impact and their likelihood of occurrence. A formal Risk Assessment, and network penetration tests, will be performed at least annually and shall take into consideration the results of any technical vulnerability management activities performed in accordance with the Operations Security Policy.

[pepicrft]

It was an oversight. Should it be in "Operations Security Policy" instead of "Risk Management Policy"? Or should it be in both?

[Sean-Klein]

I was thinking you wanted to remove the requirement for penetration tests from your policies because you removed it from Operations Security Policy. I was bringing it to your attention that you probably want to remove it from Risk Management Policy too.

[pepicrft]

Not really, it wasn't intentional. The "Operations Security Policy" that we established followed Vanta's recommendation, which doesn't include any note about penetration tests. We'd like to perform them yearly, so would you recommend in that case to add them to the "Operations Security Policy".

Also.. how did you come across our policies @Sean-Klein. I believe we never interacted before.

[Sean-Klein]

If you open the original template for Vanta's Operation Security Policy, you will see how Penetration Tests were included. If you are planning to continue with this approach, you probably want to add it back as it was in the original template and referenced by the Risk Management Policy.

How did I come across your polices? I stumbled upon your GitHub repository from an internet search looking for examples of policies I am in the process of implementing for my work. When I noticed a potential oversight while reviewing some of your policies, I reached out to you out of courtesy.