Technical Guide to Information Security Testing and Assessment

Key concepts

The guide covers review techniques, target identification and analysis, vulnerability validation (including penetration testing), assessment planning and execution, and post-testing activities such as reporting and remediation.

How it is organized

• Security testing overview
• Review techniques
• Target identification and analysis
• Target vulnerability validation
• Assessment planning
• Assessment execution
• Post-testing activities
• Appendix: rules of engagement template

What a school district should take from it

• Agree on scope, timing and contacts in writing before any test, especially around testing days and school events.
• A test report only adds value once findings become owned fixes.

How to use it in your district

1. Use the rules-of-engagement template when contracting a penetration test.
2. Schedule external scans (for example from free government services) and track findings.
3. Turn each significant finding into an Improvement plan item with a due date.

Common misconceptions

A penetration test proves the district is secure.

It is a point-in-time check of a defined scope; unaddressed findings and untested areas remain.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• ID.RARisk Assessment
• ID.IMImprovement
• DE.CMContinuous Monitoring

Tools in the program portal

• Improvement planGive each gap an owner, a date and a first step
• Vulnerability alertsKnown exploited vulnerabilities that match your systems
• P3 Partner NetworkFind vetted help matched to your gaps
• Evidence LockerKeep the artifact that shows a practice is in place

Related publications

• SP 800-53A Rev. 5Assessing controls
• SP 800-30 Rev. 1Conducting risk assessments