The report becomes evidence, not a file in a folder
The pentest report is the document most often requested in ISO 27001 and PCI DSS audits. A folder holds the report. The module holds what the auditor actually asks for: the scope from your own inventory, IT systems, networks, ASM domains and applications, the classification per the BSI implementation concept with the mandatory test actions derived from it, the cycle with the next due date and the exclusion list with reasons. Findings carry a CVSS vector, the affected system, a treatment decision and a remediation deadline frozen at creation. The evidence serves PCI DSS 11.4, DORA Art. 24 to 26, ISO 27001 A.8.8 and A.8.29 and Section 39 BSIG.
The BSI implementation concept has 45 modules. Six classification criteria exclude modules; every module they do not exclude is mandatory. Anyone leaving one out anyway does so with a documented reason, and it appears struck through rather than vanishing.
Clean, or never tested. Only a documented exclusion separates the two. When a target in the scope is deselected, it moves to the exclusion list and needs a reason. That is exactly what the auditor asks about.
A finding’s remediation deadline is computed from its severity at creation and is not moved afterwards if someone changes the defaults. Reminder, measure and task arise from the finding; the retest takes over the open findings and feeds back to the original.
A pentest that carries as evidence in the audit: with scope, exclusions, mandatory modules and deadlines, not just a PDF.
Schedule a no-obligation demo – we will show you the module with your own use cases.
