Policy 14 — Security & Penetration Testing Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 14. Values shown as [X] are placeholders still to be set.

Purpose

To validate the effectiveness of security controls through regular scanning and periodic penetration testing.

Scope

Applies to all internet-facing and internal Revique systems within scope.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Internal and external vulnerability scans must be performed on a defined schedule and after significant changes.

2External scans must be performed by a qualified provider (e.g. an approved scanning vendor) as required.

3A penetration test must be conducted at least annually and after significant changes.

4Identified issues must be remediated and re-tested to confirm closure.

5Testing results must be documented and retained.

Roles & responsibilities

Role	Responsibility
Security Officer	Schedule testing and track remediation.
Engineering / DevOps	Remediate findings and support re-testing.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→