Mobile app penetration testing

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the penetration testing procedure; confirm it requires an independent tester and defines the annual cadence and scope.
2. 2.Confirm the defined scope includes both iOS and Android channels.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Confirm a penetration test was completed within the last 12 months by a party independent of the development team.
2. 2.Select the findings from the latest test and confirm remediation status is tracked to closure.
3. 3.Confirm high and critical findings were remediated or risk-accepted within the defined timeline.

Linked risks

• Mobile channel account takeovermitigation 2
• API security weaknessmitigation 1

Framework mappings & latest test