• Section 1 - Overview
• Section 2 - Scope
• Section 3 - Policy
• Section 4 - Procedures
• Section 5 - Guidelines
• Section 6 - Definitions

Section 1 - Overview

(1) This Policy sets out our commitment to conducting penetration tests in a controlled, responsible and proportionate manner to identify and validate vulnerabilities while protecting our information, information assets, products and services.

(2) Penetration Tests are is undertaken to strengthen the security of our products, services and information assets by identifying and validating vulnerabilities and supporting their timely remediation. It is intended to demonstrate the existence and potential impact of vulnerabilities using the minimum level of access, interaction and information necessary to achieve the objectives of each engagement.

(3) We recognise that penetration tests are an important component of our broader information security framework and will be undertaken in a manner that balances effective security assurance with the protection of our information, information assets, products, services and the interests of our clients.

Section 2 - Scope

(4) This Policy applies to all penetration tests undertaken by or on our behalf in relation to our products, services and information assets.

(5) This Policy applies whether penetration tests are undertaken by our personnel or by third parties acting on our behalf.

Section 3 - Policy

(6) We will ensure that penetration tests:

1. are undertaken at intervals appropriate to the level of risk presented by our products, services and information assets;
2. are undertaken following significant changes that may materially affect the security of our products, services or information assets;
3. are authorised before testing commences;
4. are conducted only within an approved scope;
5. are planned and undertaken in a manner that minimises the risk of disruption to our operations and the operations of our clients;
6. are conducted using techniques that are proportionate to the objectives of the engagement;
7. are undertaken in accordance with applicable legislation, contractual obligations and our corporate governance framework;
8. demonstrate the existence and potential impact of vulnerabilities using the minimum level of access, interaction and information necessary to achieve the objectives of the engagement; and
9. are appropriately documented and reported.

(7) Where penetration testing results in access to information or information assets, we require that:

1. only the minimum access reasonably necessary to validate the vulnerability is obtained;
2. examination of information ceases as soon as sufficient evidence has been obtained to validate the vulnerability;
3. information is not intentionally browsed, searched, analysed or otherwise examined beyond that reasonably necessary to validate the vulnerability;
4. information is not copied, extracted, retained or disclosed except where necessary to document the finding;
5. all information included in evidence or reports is limited to the minimum necessary to support the finding;
6. where evidence or reports contain sensitive information or confidential information, that information is excluded or redacted wherever reasonably practicable;
7. information obtained during testing is appropriately protected while retained; and
8. information obtained during testing is securely disposed of when it is no longer required for the purposes of the engagement.

(8) Unless expressly authorised in writing, penetration tests must not:

1. intentionally disrupt or degrade production services;
2. intentionally alter, delete or corrupt information;
3. establish persistent or ongoing access to any system;
4. exceed the approved scope of the engagement; or
5. disclose information obtained during testing to any unauthorised person.

Section 4 - Procedures

(9) Procedures are agreed for each authorised penetration test, aligned with this Policy.

Section 5 - Guidelines

(10) Nil.

Section 6 - Definitions

(11) Definitions applicable to this Policy are contained in the Corporate Glossary.