<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: implementing-compliance-penetration-testing
subdomain: security-testing
title: "Implementing Compliance Penetration Testing"
tags:
  - compliance
  - PCI-DSS
  - SOC2
  - HIPAA
  - FedRAMP
  - penetration-testing
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Compliance Penetration Testing

> Conduct penetration tests that satisfy regulatory compliance requirements including PCI DSS, SOC 2, HIPAA, and FedRAMP mandates.

## Overview

Compliance penetration testing satisfies regulatory mandates that require periodic security assessments. This technique covers compliance-specific scoping, evidence collection, regulatory reporting requirements, and remediation verification for PCI DSS, SOC 2, HIPAA, and FedRAMP.

## Core Concepts

- **PCI DSS requirements**: Quarterly ASV scans, annual penetration testing (Req 11.3/11.4)
- **SOC 2 criteria**: Security testing mapped to Trust Services Criteria
- **HIPAA testing**: Technical safeguard assessment for ePHI systems
- **FedRAMP requirements**: Annual penetration testing with specific methodology requirements
- **Evidence chain**: Maintain audit-grade documentation of testing activities

## Workflow

1. Identify applicable compliance frameworks and testing requirements
2. Define scope based on compliance boundaries (CDE, trust boundary)
3. Map test cases to specific compliance requirements
4. Conduct penetration testing with compliance-aware methodology
5. Document each test with evidence linked to requirements
6. Classify findings using compliance-specific severity ratings
7. Generate compliance-formatted penetration test report
8. Support remediation verification and retesting
9. Prepare evidence package for auditor review
10. Archive test artifacts per compliance retention requirements

## Implementation

```python
from dataclasses import dataclass, field
from datetime import datetime
from enum import Enum
from typing import Optional


class ComplianceFramework(Enum):
    PCI_DSS = "PCI DSS"
    SOC2 = "SOC 2"
    HIPAA = "HIPAA"
    FEDRAMP = "FedRAMP"


@dataclass
class ComplianceRequirement:
    framework: ComplianceFramework
    requirement_id: str
    description: str
    test_cases: list[str] = field(default_factory=list)
    satisfied: bool = False


@dataclass
class ComplianceFinding:
    title: str
    severity: str
    requirements: list[str]
    evidence: str
    remediation: str
    retested: bool = False
    remediated: bool = False


class CompliancePenTestManager:
    """Compliance-driven penetration testing management."""

    def __init__(self, framework: ComplianceFramework) -> None:
        self.framework = framework
        self.requirements: list[ComplianceRequirement] = []
        self.findings: list[ComplianceFinding] = []
        self.test_date: datetime = datetime.utcnow()

    def add_requirement(self, req: ComplianceRequirement) -> None:
        self.requirements.append(req)

    def add_finding(self, finding: ComplianceFinding) -> None:
        self.findings.append(finding)

    def compliance_coverage(self) -> dict:
        total = len(self.requirements)
        satisfied = sum(1 for r in self.requirements if r.satisfied)
        return {
            "framework": self.framework.value,
            "total_requirements": total,
            "satisfied": satisfied,
            "coverage_pct": round(satisfied / total * 100, 1) if total else 0,
        }

    def unremediated_findings(self) -> list[ComplianceFinding]:
        return [f for f in self.findings if not f.remediated]

    def audit_summary(self) -> dict:
        return {
            "framework": self.framework.value,
            "test_date": self.test_date.isoformat(),
            "total_findings": len(self.findings),
            "remediated": sum(1 for f in self.findings if f.remediated),
            "pending": len(self.unremediated_findings()),
            "compliance_coverage": self.compliance_coverage(),
        }
```

## Best Practices

- Scope testing precisely to compliance boundaries—out-of-scope testing wastes time
- Map every test case to specific compliance requirements for traceability
- Collect evidence in real-time—reconstructing after testing is error-prone
- Use compliance-specific severity ratings, not just CVSS
- Schedule retesting within the compliance remediation window
- Archive all test artifacts for the required retention period (PCI: 1 year, HIPAA: 6 years)

## Detection

```yaml
title: Compliance Penetration Testing Detection
id: d96a86a7-2b3b-47a4-9332-5e8f7164e500
status: experimental
description: Detects suspicious activity related to implementing compliance penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*compliance*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Compliance Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Related Techniques

- [Building Security Testing Methodology](../building-security-testing-methodology/SKILL.md)
- [Performing Wireless Penetration Testing](../performing-wireless-penetration-testing/SKILL.md)
