--- title: Cybersecurity Frameworks description: Navigating cybersecurity compliance with Redstone Security. image: https://redstonesec.com/hubfs/RSO%20-%20Icon%20Large_Threat%20Modeling%20and%20Analysis%20(10-4-2022)-1.jpg --- [![RedstoneSecurity_logo-white-3](https://redstonesec.com/hubfs/RedstoneSecurity_logo-white-3.svg "RedstoneSecurity_logo-white-3")](https://redstonesec.com/?hsLang=en) - [Home](https://redstonesec.com) - [Services](https://redstonesec.com/services) - [Penetration Testing](https://redstonesec.com/pentest) - [Vulnerability Scan](https://redstonesec.com/vulnerability-scan) - [Adversary Assessment](https://redstonesec.com/adversary-assessment) - [Strategic Threat Assessment](https://redstonesec.com/threat-assessment) - [Resources](https://redstonesec.com/cybersecurity-frameworks) - [Case Studies](https://redstonesec.com/case-studies) - [Cybersecurity Frameworks](https://redstonesec.com/cybersecurity-frameworks) - [Blog](https://redstonesec.com/blog) - [News](https://www.linkedin.com/company/redstone-security/) - [About](https://redstonesec.com/about) - [Contact Us](https://redstonesec.com/contact-us) [![logo_only Favicon](https://redstonesec.com/hs-fs/hubfs/logo_only%20Favicon.png?width=48&height=47&name=logo_only%20Favicon.png "logo_only Favicon")](https://redstonesec.com/?hsLang=en) [![RedstoneSecurity_logo-white-3](https://redstonesec.com/hubfs/RedstoneSecurity_logo-white-3.svg "RedstoneSecurity_logo-white-3")](https://redstonesec.com/?hsLang=en) - [Home](https://redstonesec.com) - [Services](https://redstonesec.com/services) - [Penetration Testing](https://redstonesec.com/pentest) - [Vulnerability Scan](https://redstonesec.com/vulnerability-scan) - [Adversary Assessment](https://redstonesec.com/adversary-assessment) - [Strategic Threat Assessment](https://redstonesec.com/threat-assessment) - [Resources](https://redstonesec.com/cybersecurity-frameworks) - [Case Studies](https://redstonesec.com/case-studies) - [Cybersecurity Frameworks](https://redstonesec.com/cybersecurity-frameworks) - [Blog](https://redstonesec.com/blog) - [News](https://www.linkedin.com/company/redstone-security/) - [About](https://redstonesec.com/about) - [Contact Us](https://redstonesec.com/contact-us) [![logo_only Favicon](https://redstonesec.com/hs-fs/hubfs/logo_only%20Favicon.png?width=48&height=47&name=logo_only%20Favicon.png "logo_only Favicon")](https://redstonesec.com/?hsLang=en) - [Services](https://redstonesec.com/services) - [Pentesting](https://redstonesec.com/pentest) - [About Us](https://redstonesec.com/about) - [Schedule Today](https://redstonesec.com/contact-us) # Navigating Cybersecurity Frameworks and Requirements ##### Stay current with evolving regulations, guidelines, requirements and frameworks. [Compliance Consultation](https://redstonesec.com/contact-us?hsLang=en) ## Common Frameworks Penetration Testing Execution Standard (PTES) OWASP Continuous Penetration Testing Framework Open Source Security Testing Methodology (OSSTMM) PCI Penetration Testing Guide NIST 800-115 Information Systems Security Assessment Framework (ISSAF) ### Penetration Testing Penetration test (pentest) is a simulated cyber attack on a computer system, network, cloud or application to identify vulnerabilities that could be exploited by real attackers. ### Vulnerability Scans A vulnerability scan is an automated process that scans computer systems, networks, or applications for known vulnerabilities, such as missing patches or misconfigurations, without exploiting them. ### Security Audit Unlike pentests, which exploit vulnerabilities to assess the effectiveness of security controls, a security audit typically involves a more passive review and analysis of security measures. ![RSO - Icon Large_Threat Modeling and Analysis (10-4-2022)](https://redstonesec.com/hubfs/RSO%20-%20Icon%20Large_Threat%20Modeling%20and%20Analysis%20(10-4-2022).jpg "RSO - Icon Large_Threat Modeling and Analysis (10-4-2022)") ## NIST - National Institude of Standards and Technology ### Cybersecurity framework for any sized business  The NIST Cybersecurity Framework **helps businesses of all sizes better understand, manage, and reduce their cybersecurity risk and protect their networks and data**. NIST is mandatory for government agencies and companies that do business with the US government. Other business should comply with NIST for liability reasons but it is not mandatory.  [NIST 800-115:](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-115.pdf) 1. Regular assessment and review of information security policies, procedures, and practices are crucial, with a frequency tailored to the level of risk but conducted at least annually. 2. Pretest analysis requires comprehensive understanding of systems and components, identifying all potential vulnerabilities before exploitation. 3. Rigorous testing is then employed to determine the exploitability of identified vulnerabilities. Additional controls in[NIST SP 800-53](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf): CA-8(1) mandates independent penetration testing teams, ensuring unbiased assessments. CA-8(2) requires red team exercises to simulate real-world attacks, providing comprehensive security assessments beyond penetration tests. ## PCI DSS - Payment Card Industry Data Security Standard ### Mandatory for any entity that handles, stores, or transmits cardholder data Cardholder data encompasses debit, credit, and prepaid card information utilized by customers, regardless of business size or transaction volume. The [PCI DSS Requirement 11.3](https://listings.pcisecuritystandards.org/pdfs/infosupp_11_3_penetration_testing.pdf) mandates penetration testing at least annually or whenever significant changes are made to the environment. ![RSO - Icon Small_Network Penetration Testing (10-4-2022)](https://redstonesec.com/hubfs/RSO%20-%20Icon%20Small_Network%20Penetration%20Testing%20(10-4-2022).jpg "RSO - Icon Small_Network Penetration Testing (10-4-2022)") ![RSO - Icon Large_Physical Security Assessment (10-4-2022)](https://redstonesec.com/hubfs/RSO%20-%20Icon%20Large_Physical%20Security%20Assessment%20(10-4-2022).jpg "RSO - Icon Large_Physical Security Assessment (10-4-2022)") ## HIPPA - Health Insurance Portability and Accountability Act ### Protecting Health and Medical PII While the [HIPAA security rule](https://www.govinfo.gov/content/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-sec164-308.pdf) doesn't explicitly address vulnerability scans or penetration tests, compliance necessitates Health and Human Services to mandate a technical vulnerability assessment for all IT assets, encompassing web and network components. Covered entities are defined in the HIPAA rules as: 1. Health plans 2. Health care clearinghouses 3. Health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. ## Achieve and Maintain Compliance Let us help you maintain your industry standards for cybersecurity threat and liabiality prevention. [Let us know how we can Help](https://redstonesec.com/contact-us?hsLang=en) - [Privacy Policy](https://redstonesec.com/privacy-policy) [Follow us on Facebook](https://www.linkedin.com/company/redstone-security/) [Follow us on Facebook](https://www.facebook.com/profile.php?id=61556092130784&_rdr) [Follow us on Facebook](https://www.youtube.com/channel/UChXzBRm3uoZSVLxZYg-odOA?app=desktop) [Follow us on Facebook](https://x.com/RedstoneOps) ![logo_only-1](https://redstonesec.com/hs-fs/hubfs/logo_only-1.png?width=150&height=146&name=logo_only-1.png "logo_only-1") --- © [Redstone Security](https://redstonesec.com?hsLang=en)2024| All rights reserved. ![](https://f.hubspotusercontent00.net/hubfs/7712601/back-to-top.png)