Testing that answers to your regulator.
We scope and report against the frameworks you already work under, so your auditors can use the findings as they stand.
Frameworks by jurisdiction.
Framework names are the published titles. We work to the edition in force when your engagement is scoped.
United States
- NIST SP 800-115
- Technical Guide to Information Security Testing and Assessment. Our planning, execution and post-testing phases follow its structure, and the technical report notes any departure from it.
- NIST Cybersecurity Framework 2.0
- Findings map to CSF 2.0 functions, categories and subcategories, from Govern through Recover, so they fit the current and target profiles you already keep.
- FFIEC guidance
- For banks and credit unions, reports are organized so examiners can trace testing to the assurance and testing expectations in the FFIEC IT Examination Handbook, Information Security booklet.
- CMMC
- For defense contractors, test evidence can be arranged against the CMMC practices your assessor will review. Certification assessments are carried out by authorized third-party assessment organizations, and Bendings does not perform them.
Kingdom of Bahrain
- Central Bank of Bahrain Rulebook
- For CBB licensees, scope and reporting follow the cyber security requirements in the Rulebook volume that covers your license.
- National Cyber Security Center
- For government entities and critical national infrastructure, testing aligns with NCSC standards and guidance, and results are handled as your security function directs.
Kingdom of Saudi Arabia
- NCA Essential Cybersecurity Controls
- Findings map to ECC domains and subdomains, including penetration testing and vulnerability management, so they feed straight into your compliance evidence.
- SAMA Cyber Security Framework
- Findings map to the framework’s domains and subdomains, so your compliance team can reflect them in its maturity self-assessment.
- SAMA Financial Entities Ethical Red Teaming framework
- Red team engagements are planned around the framework’s phases and roles. Where the framework sets requirements for the red team provider, we check them with you before scoping.
State of Qatar
- National Information Assurance Standard
- Findings map to the standard’s control domains, for government bodies and critical sector organizations.
- National Cyber Security Agency guidance
- We follow the NCSA guidance that applies to your sector and confirm with you which edition your auditors assess against.
Threat-led schemes elsewhere
- CBEST
- Intelligence-led testing for UK financial firms, overseen by the Bank of England.
- TIBER-EU
- The European Central Bank’s framework for threat intelligence-based ethical red teaming, adopted by national authorities.
- DORA threat-led penetration testing
- Required of certain EU financial entities under the Digital Operational Resilience Act, Regulation (EU) 2022/2554.
These schemes require their threat intelligence and red team providers to be accredited or approved under the scheme’s own rules. At scoping we tell you plainly whether we can take the tester role in your test, or whether we should support the provider you choose as an adviser.
How a finding becomes audit evidence.
-
Agree the framework
At scoping we record which frameworks apply and which edition of each, so the mapping is fixed before testing starts.
-
Name the controls
Each finding lists the controls it bears on, by the framework’s own identifiers and titles.
-
Keep the evidence attached
Screenshots and log entries stay referenced to the finding, so an auditor can check any claim without asking us.
-
Update at retest
The retest letter carries the same mapping, so control status changes on the date the fix is confirmed.
- Finding
- A legacy remote access gateway accepts a password without a second factor.
- Severity
- High, with the rating method stated in the report
- Evidence
- Screenshots and activity log entries, referenced by number
- Status
- Open until retest
| Framework | Control | Title |
|---|---|---|
| NIST CSF 2.0 | PR.AA-03 | Users, services, and hardware are authenticated |
| NCA ECC | 2-2 | Identity and Access Management |
| SAMA CSF | 3.3.5 | Identity and Access Management |
What we say plainly before you sign.
Regulated buyers need to know where a vendor’s standing ends. These points hold for every framework on this page.
- Approval
- Nothing on this page is a claim of regulatory approval, panel membership or accreditation. If your scheme requires any of these, we tell you at the first conversation whether we meet the requirement.
- Certification
- Testing produces evidence for your compliance work. It does not certify you against any framework, and our reports say so.
- Editions
- Frameworks change. Every report names the edition we mapped against.
- Judgment
- The mapping is our view of which controls a finding bears on. Your auditors and your regulator make their own assessment.
Name the framework you answer to.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.