Security questionnaire answers › Infrastructure
Do you perform penetration testing? How to answer it in a security questionnaire
Why buyers ask this
Independent testing shows that weaknesses are being found and fixed before attackers find them.
What a strong answer includes
- Give frequency (at least annually) and whether an independent third party performs it.
- Say how findings are tracked and remediated, with timeframes by severity.
- Offer a summary or letter rather than the full report.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. An independent third party performs a penetration test of our application and infrastructure at least [annually] and after major changes. Findings are tracked to closure, with critical and high issues remediated within [X] days. An executive summary is available under NDA.
Evidence to attach
- Penetration test summary or attestation letter
- Remediation tracker
Common mistakes
- Promising the full report to every customer.
- Automated scans described as penetration tests.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.