Testing rules compared, US, Gulf and benchmarks.
All 84 rules on the dimensions that decide what a test looks like, grouped by country. Each name opens the rule in full, with the clause and quote behind every code. Reviewed October 30, 2026.
How each rule tests.
Whether the rule binds, how often it tests, what it asks of testers and of the regulator, and whether it reaches for threat intelligence, replay, retests or automation. Codes are words; the square only helps the eye, and Not addressed means the full text is silent.1
| Rule | Legal force | How often | Threat intel | Tester rules | In-house testers | Purple or replay | Retest | Regulator role | Automation, AI |
|---|---|---|---|---|---|---|---|---|---|
| United States19 | |||||||||
| NYDFS Part 500 | Mandatory | Annual | Not addressed | Required | Allowed | Not addressed | Required | Examines | Addressed |
| FFIEC IS booklet | Supervisory | Risk-based | Not addressed | Recommended | Allowed | Not addressed | Recommended | Examines | Addressed |
| FFIEC CAT (sunset) | Voluntary | Risk-based | Recommended | Recommended | Not addressed | Not addressed | Recommended | Not addressed | Addressed |
| SEC Reg SCI | Mandatory | Every 3 years | Not addressed | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| CFTC system safeguards | Mandatory | Annual (DCOs, SDRs, covered DCMs) | Required | Required | With conditions | Not addressed | Required | Examines | Addressed |
| Interagency security guidelines | Mandatory | Risk-based | Not addressed | Recommended | With conditions | Not addressed | Recommended | Examines | Not addressed |
| FTC Safeguards Rule | Mandatory | Annual (unless continuous monitoring) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Not addressed | Addressed |
| FISMA + NIST 800-53 | Mandatory | Annual (statute); CA-8 org-defined | Recommended | Required | With conditions | Not addressed | Required | Examines | Addressed |
| FedRAMP Rev5 (legacy) | Mandatory | Annual | Recommended | Required | With conditions | Not addressed | Required | Receives results | Addressed |
| FedRAMP CR26 / 20x | Mandatory | Annual independent assessment | Not addressed | Required | With conditions | Not addressed | Required | Examines | Addressed |
| CISA HVA (BOD 18-02) | Mandatory | Every 3 years | Recommended | Required | With conditions | Not addressed | Required | Leads the test | Addressed |
| OMB M-22-09 | Mandatory | Periodic, as systems change | Not addressed | Required | With conditions | Not addressed | Required | Examines | Addressed |
| OCC GENIUS Act rule (12 CFR 15) | Mandatory | Periodic, no interval set | Not addressed | Required | With conditions | Not addressed | Required | Examines | Not addressed |
| FHFA information security bulletins | Supervisory | Risk-based | Not addressed | Recommended | With conditions | Not addressed | Required | Examines | Addressed |
| FCA cyber risk management rule | Mandatory | Risk-based | Not addressed | Required | With conditions | Not addressed | Required | Not addressed | Not addressed |
| Fed Regulation HH (designated FMUs) | Mandatory | Annual (business continuity); periodic and after major changes (other tests) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| SEC Regulation SE system safeguards | Mandatory | Risk-based | Required | Required | With conditions | Not addressed | Required | Examines | Addressed |
| IRS Pub 1075 | Mandatory | Every 3 years | Recommended | Recommended | With conditions | Not addressed | Required | Examines | Addressed |
| CMS ARC-AMPE | Mandatory | Annual | Recommended | Required | With conditions | Not addressed | Required | Receives results | Addressed |
| Saudi Arabia10 | |||||||||
| SAMA CSF | Mandatory | Annual | Not addressed | Required | Not addressed | Not addressed | Required | Examines | Not addressed |
| SAMA FEER | Mandatory | Every 3 years | Required | Required | Not allowed | Required | Required | Leads the test | Not addressed |
| SAMA CRFR | Mandatory | Every 6 months | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Examines | Addressed |
| NCA ECC-2:2024 | Mandatory | Periodic (entity-defined) | Not addressed | Recommended | Not addressed | Not addressed | Required | Examines | Not addressed |
| NCA CSCC-2:2026 | Mandatory | Every 6 months | Not addressed | Required | Not addressed | Not addressed | Required | Examines | Not addressed |
| NCA OTCC-1:2022 | Mandatory | 3, 6 or 12 months by facility level | Not addressed | Required | Not addressed | Not addressed | Required | Examines | Not addressed |
| CMA Cybersecurity Guidelines | Mixed | Annual | Not addressed | Required | Not addressed | Not addressed | Required | Examines | Not addressed |
| NCA CCC-2:2024 | Mandatory | Every 6 months | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Not addressed |
| NCA TCC-1:2021 | Mandatory | Annual | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Not addressed |
| SAMA IPO Rules | Mandatory | Not specified | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Examines | Not addressed |
| United Arab Emirates10 | |||||||||
| CBUAE operational risk regulation | Mandatory | Periodic, interval not set | Not addressed | Required | With conditions | Not addressed | Required | Examines | Not addressed |
| CBUAE retail payment services regulation | Mandatory | Risk-based | Required | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| Enabling technologies guidelines | Supervisory | Annual | Not addressed | Recommended | With conditions | Not addressed | Not addressed | Not addressed | Addressed |
| DFSA GEN 5.5 (DIFC) | Mandatory | Annual (internet-facing) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| ADGM FSRA GEN 3.5 | Mixed | Annual (internet-facing) | Recommended | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| UAE IA Standard v2.1 | Mandatory | Not addressed | Not addressed | Required | With conditions | Not addressed | Required | Leads the test | Addressed |
| Dubai DESC ISR | Mandatory | Not public | Not public | Required | Not public | Not public | Not public | Examines | Not public |
| CMA VASP and ATS Regulation 2026 | Mandatory | Annual (internet-connected systems) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Not addressed |
| CBUAE retail payment systems regulation | Mandatory | Periodic, interval not set | Not addressed | Not addressed | With conditions | Not addressed | Not addressed | Examines | Not addressed |
| CBUAE electronic insurance regulations | Mandatory | Regular, interval not set | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| Qatar9 | |||||||||
| QCB technology risks for banks | Mandatory | Every 6 months | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| QCB insurance cyber regulation | Mandatory | Every 6 months | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| QCB payment service provider regulation | Mandatory | Every 6 months | Required | Required | Not allowed | Not addressed | Required | Not addressed | Addressed |
| QCB financial services operator instructions | Mandatory | Regularly (not specified) | Not addressed | Required | Not allowed | Not addressed | Not addressed | Examines | Not addressed |
| QFCRA CTRL 8.5 | Mixed | Risk-based | Not addressed | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| NCSA NIA Standard v2.1 | Mixed | Annual (pentest optional) | Not addressed | Recommended | With conditions | Not addressed | Required | Examines | Not addressed |
| NCSA penetration testing accreditation | Mixed | Not addressed | Not addressed | Required | Not addressed | Not addressed | Recommended | Examines | Addressed |
| QFMA and NCSA controls for markets | Mandatory | Monthly scans; no pentest | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| NCSA vulnerability management guidelines | Mixed | Daily scans (agent assets); no pentest cycle | Not addressed | Not addressed | Allowed | Not addressed | Recommended | Examines | Addressed |
| Bahrain9 | |||||||||
| CBB OM-5.5 banks | Mandatory | Every 6 months | Recommended | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| CBB RM-9 insurance and investment | Mandatory | Annual | Recommended | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| NCSC baseline controls | Mandatory | Annual | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| NCSC critical-sector standards | Mandatory | Not public | Not public | Not public | Not public | Not public | Not public | Examines | Not public |
| CBB GR-12.2 payments and open banking | Mandatory | Every 6 months | Recommended | Required | Not allowed | Not addressed | Required | Receives results | Not addressed |
| CBB CRA-5.8 crypto-asset | Mandatory | Every 6 months | Recommended | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| CBB SIO-9.6 stablecoin issuers | Mandatory | Every 6 months | Recommended | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| CBB RM-3 money changers | Mandatory | Every 6 months | Recommended | Required | With conditions | Not addressed | Required | Receives results | Not addressed |
| CBB OM-5.2 financing companies | Mandatory | Every 6 months | Not addressed | Required | Not addressed | Not addressed | Required | Receives results | Not addressed |
| Kuwait3 | |||||||||
| CBK CORF | Mandatory | Annual | Required | Required | Not addressed | Recommended | Required | Examines | Addressed |
| NCSC national baseline controls | Mandatory | Monthly scans; no pentest | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Addressed |
| CBK e-payment cyber minimum | Mandatory | Pre-launch only | Not addressed | Required | With conditions | Not addressed | Required | Not addressed | Not addressed |
| Oman11 | |||||||||
| CBO CS&RF | Mandatory | Annual (internet-facing) | Not addressed | Recommended | Not addressed | Not addressed | Required | Examines | Not addressed |
| MTCIT government security assessment | Mandatory | Every 1 to 2 years | Not addressed | Required | Not addressed | Not addressed | Required | Not addressed | Addressed |
| CBO BCM framework | Mixed | Every 3 years (TLPT of critical systems) | Required | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| CBO open banking framework | Mandatory | Periodic, before go-live and on change | Not addressed | Not addressed | Not addressed | Not addressed | Required | Receives results | Addressed |
| CBO PSP licensing policy | Mandatory | Annual (online services) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Examines | Not addressed |
| CBO BNPL framework | Mandatory | Annual (online services) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Receives results | Not addressed |
| CBO digital bank framework | Mandatory | On CBO request | Not addressed | Required | Not allowed | Not addressed | Not addressed | Examines | Not addressed |
| FSA listed company guidelines | Mandatory | Annual | Not addressed | Required | With conditions | Not addressed | Required | Not addressed | Not addressed |
| CDC external cloud policy | Mandatory | Not specified | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Examines | Not addressed |
| MTCIT managed services standards | Mandatory | Periodic (not specified) | Not addressed | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| MTCIT government mobile app standards | Mandatory | Before launch | Not addressed | Required | Not allowed | Not addressed | Required | Examines | Not addressed |
| International benchmarks13 | |||||||||
| UK CBEST United Kingdom | Supervisory | At regulator request | Required | Required | Not allowed | Not addressed | Required | Leads the test | Addressed |
| EU TIBER-EU European Union | Mixed | Every 3 years (norm) | Required | Required | With conditions | Required | Required | Leads the test | Not addressed |
| EU DORA TLPT European Union | Mandatory | Every 3 years | Required | Required | With conditions | Required | Required | Leads the test | Addressed |
| HK iCAST (C-RAF 2.0) Hong Kong | Supervisory | Regular; interval not public | Required | Required | Not public | Not public | Recommended | Examines | Not public |
| HK PCICSO code of practice Hong Kong | Mandatory | Annual | Recommended | Recommended | Not addressed | Not addressed | Required | Receives results | Not addressed |
| SG ABS AASE Singapore | Voluntary | Risk-based; at least every 24 months | Recommended | Recommended | Allowed | Recommended | Recommended | Not addressed | Addressed |
| SG MAS TRM section 13 Singapore | Supervisory | Annual (internet-facing systems) | Recommended | Not addressed | Not addressed | Not addressed | Recommended | Examines | Addressed |
| SG CSA CCoP 2026 Singapore | Mandatory | Red or purple team every 24 months; pen test and vulnerability assessment every 12 months (IT), 24 months (OT) | Required | Required | Not addressed | Recommended | Required | Receives results | Addressed |
| SG MAS AI risk management guidelines Singapore | Supervisory | Before deployment; then risk-based re-validation | Not addressed | Not addressed | With conditions | Not addressed | Recommended | Examines | Addressed |
| AU CFR CORIE v2.0 Australia | Supervisory | Set by regulator per tier | Required | Required | Not allowed | Recommended | Recommended | Leads the test | Addressed |
| AU APRA CPS 234 Australia | Mandatory | Risk-based; program reviewed annually | Not addressed | Required | With conditions | Not addressed | Required | Receives results | Addressed |
| AU APRA AI letter 2026 Australia | Supervisory | Before AI deployment and throughout the lifecycle; no interval | Not addressed | Not addressed | With conditions | Not addressed | Recommended | Examines | Addressed |
| AU SOCI SoNS tests Australia | Mandatory | On the Secretary’s notice | Not addressed | Not addressed | Allowed | Not addressed | Not addressed | Leads the test | Not addressed |
Which seams each rule reaches.
Whether the test must cross from systems into people, buildings, suppliers, operational technology and cloud services, and whether the rule deals with other jurisdictions. Codes are words; the square only helps the eye, and Not addressed means the full text is silent.1
| Rule | Human seam | Physical seam | Supplier seam | OT | Cloud, SaaS | Cross-border |
|---|---|---|---|---|---|---|
| United States19 | ||||||
| NYDFS Part 500 | Permitted | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| FFIEC IS booklet | Permitted | Controls only | Assurance only | Not addressed | Assurance only | Not addressed |
| FFIEC CAT (sunset) | Permitted | Not addressed | Permitted | Not addressed | Not addressed | Not addressed |
| SEC Reg SCI | Not addressed | Controls only | Required | Not addressed | Not addressed | Not addressed |
| CFTC system safeguards | Controls only | Controls only | Required | Not addressed | Not addressed | Not addressed |
| Interagency security guidelines | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| FTC Safeguards Rule | Not addressed | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| FISMA + NIST 800-53 | Permitted | Permitted | Required | Permitted | Permitted | Not addressed |
| FedRAMP Rev5 (legacy) | Required | Permitted | Required | Not addressed | Required | Not addressed |
| FedRAMP CR26 / 20x | Not addressed | Not addressed | Required | Not addressed | Required | Not addressed |
| CISA HVA (BOD 18-02) | Permitted | Not addressed | Required | Permitted | Required | Not addressed |
| OMB M-22-09 | Not addressed | Not addressed | Required | Not addressed | Permitted | Not addressed |
| OCC GENIUS Act rule (12 CFR 15) | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Addressed |
| FHFA information security bulletins | Permitted | Not addressed | Assurance only | Not addressed | Permitted | Not addressed |
| FCA cyber risk management rule | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| Fed Regulation HH (designated FMUs) | Not addressed | Controls only | Assurance only | Not addressed | Not addressed | Not addressed |
| SEC Regulation SE system safeguards | Controls only | Controls only | Not addressed | Not addressed | Not addressed | Not addressed |
| IRS Pub 1075 | Required | Controls only | Required | Not addressed | Assurance only | Addressed |
| CMS ARC-AMPE | Required | Controls only | Assurance only | Not addressed | Permitted | Not addressed |
| Saudi Arabia10 | ||||||
| SAMA CSF | Not addressed | Not addressed | Assurance only | Not addressed | Assurance only | Not addressed |
| SAMA FEER | Permitted | Permitted | Not addressed | Not addressed | Not addressed | Not addressed |
| SAMA CRFR | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| NCA ECC-2:2024 | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Addressed |
| NCA CSCC-2:2026 | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Addressed |
| NCA OTCC-1:2022 | Required | Required | Assurance only | Required | Not addressed | Addressed |
| CMA Cybersecurity Guidelines | Not addressed | Not addressed | Assurance only | Not addressed | Assurance only | Addressed |
| NCA CCC-2:2024 | Not addressed | Not addressed | Required | Not addressed | Required | Addressed |
| NCA TCC-1:2021 | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| SAMA IPO Rules | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Addressed |
| United Arab Emirates10 | ||||||
| CBUAE operational risk regulation | Controls only | Controls only | Assurance only | Not addressed | Not addressed | Not addressed |
| CBUAE retail payment services regulation | Required | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| Enabling technologies guidelines | Not addressed | Not addressed | Permitted | Not addressed | Permitted | Not addressed |
| DFSA GEN 5.5 (DIFC) | Controls only | Controls only | Assurance only | Not addressed | Not addressed | Addressed |
| ADGM FSRA GEN 3.5 | Permitted | Controls only | Permitted | Not addressed | Permitted | Addressed |
| UAE IA Standard v2.1 | Not addressed | Not addressed | Permitted | Not addressed | Permitted | Not addressed |
| Dubai DESC ISR | Not public | Not public | Not public | Not public | Not public | Not public |
| CMA VASP and ATS Regulation 2026 | Controls only | Controls only | Assurance only | Not addressed | Not addressed | Not addressed |
| CBUAE retail payment systems regulation | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| CBUAE electronic insurance regulations | Not addressed | Not addressed | Required | Not addressed | Not addressed | Not addressed |
| Qatar9 | ||||||
| QCB technology risks for banks | Not addressed | Not addressed | Assurance only | Not addressed | Permitted | Addressed |
| QCB insurance cyber regulation | Not addressed | Not addressed | Assurance only | Not addressed | Permitted | Addressed |
| QCB payment service provider regulation | Not addressed | Not addressed | Permitted | Not addressed | Permitted | Addressed |
| QCB financial services operator instructions | Required | Not addressed | Permitted | Not addressed | Permitted | Addressed |
| QFCRA CTRL 8.5 | Not addressed | Controls only | Assurance only | Not addressed | Not addressed | Addressed |
| NCSA NIA Standard v2.1 | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| NCSA penetration testing accreditation | Permitted | Permitted | Not addressed | Excluded | Not addressed | Addressed |
| QFMA and NCSA controls for markets | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| NCSA vulnerability management guidelines | Not addressed | Not addressed | Not addressed | Not addressed | Permitted | Not addressed |
| Bahrain9 | ||||||
| CBB OM-5.5 banks | Permitted | Permitted | Required | Not addressed | Not addressed | Addressed |
| CBB RM-9 insurance and investment | Permitted | Not addressed | Required | Not addressed | Not addressed | Addressed |
| NCSC baseline controls | Permitted | Not addressed | Not addressed | Required | Not addressed | Not addressed |
| NCSC critical-sector standards | Not public | Not public | Not public | Not public | Not public | Not public |
| CBB GR-12.2 payments and open banking | Permitted | Not addressed | Required | Not addressed | Not addressed | Addressed |
| CBB CRA-5.8 crypto-asset | Permitted | Not addressed | Required | Not addressed | Not addressed | Not addressed |
| CBB SIO-9.6 stablecoin issuers | Permitted | Not addressed | Required | Not addressed | Not addressed | Addressed |
| CBB RM-3 money changers | Permitted | Not addressed | Required | Not addressed | Not addressed | Addressed |
| CBB OM-5.2 financing companies | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| Kuwait3 | ||||||
| CBK CORF | Required | Controls only | Assurance only | Required | Assurance only | Addressed |
| NCSC national baseline controls | Not addressed | Not addressed | Assurance only | Not addressed | Assurance only | Not addressed |
| CBK e-payment cyber minimum | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| Oman11 | ||||||
| CBO CS&RF | Permitted | Not addressed | Assurance only | Not addressed | Assurance only | Addressed |
| MTCIT government security assessment | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Addressed |
| CBO BCM framework | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Addressed |
| CBO open banking framework | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| CBO PSP licensing policy | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| CBO BNPL framework | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| CBO digital bank framework | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| FSA listed company guidelines | Controls only | Controls only | Not addressed | Not addressed | Not addressed | Not addressed |
| CDC external cloud policy | Not addressed | Not addressed | Assurance only | Not addressed | Required | Addressed |
| MTCIT managed services standards | Not addressed | Not addressed | Required | Not addressed | Not addressed | Addressed |
| MTCIT government mobile app standards | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed |
| International benchmarks13 | ||||||
| UK CBEST United Kingdom | Permitted | Excluded | Permitted | Not addressed | Not addressed | Addressed |
| EU TIBER-EU European Union | Permitted | Permitted | Permitted | Not addressed | Not addressed | Addressed |
| EU DORA TLPT European Union | Permitted | Permitted | Required | Not addressed | Not addressed | Addressed |
| HK iCAST (C-RAF 2.0) Hong Kong | Not public | Not public | Not public | Not public | Not public | Addressed |
| HK PCICSO code of practice Hong Kong | Not addressed | Not addressed | Required | Not addressed | Not addressed | Addressed |
| SG ABS AASE Singapore | Permitted | Permitted | Permitted | Permitted | Permitted | Not addressed |
| SG MAS TRM section 13 Singapore | Permitted | Not addressed | Permitted | Not addressed | Not addressed | Not addressed |
| SG CSA CCoP 2026 Singapore | Permitted | Not addressed | Assurance only | Required | Not addressed | Addressed |
| SG MAS AI risk management guidelines Singapore | Not addressed | Not addressed | Permitted | Not addressed | Not addressed | Addressed |
| AU CFR CORIE v2.0 Australia | Permitted | Permitted | Not addressed | Not addressed | Not addressed | Addressed |
| AU APRA CPS 234 Australia | Permitted | Not addressed | Assurance only | Not addressed | Not addressed | Addressed |
| AU APRA AI letter 2026 Australia | Not addressed | Not addressed | Assurance only | Not addressed | Not addressed | Not addressed |
| AU SOCI SoNS tests Australia | Not addressed | Not addressed | Not addressed | Not addressed | Not addressed | Addressed |
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1 Security testing rules dataset, Bendings, reviewed October 30, 2026 Checked October 30, 2026.
- 2
Discuss an engagement privately.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.