GDPR Pen testing

[gboy]

I manage a large college network with enterprise level infrastructure. As we all know, the GDPR is sufficiently vague in terms of the guidance on the technical requirements regarding security.With this in mind my question concerns whether it is a requirement to conduct external penetration testing of the network.Below is the guidance taken from the ICO website.The GDPR specifically requires you to have a process for regularly testing, assessing and evaluating the effectiveness of any measures you put in place. What these tests look like, and how regularly you do them, will depend on your own circumstances.Technically, you can undertake this through a number of techniques, such as vulnerability scanning and penetration testing. These are essentially ‘stress tests’ of your network and information systems, which are designed to reveal areas of potential risk and things that you can improve.In some industries, you are required to undertake tests of security measures on a regular basis. The GDPR now makes this an obligation for all organisations.Personally I feel that we should undertake this as belt & braces precaution to err on the side of caution & prove we are taking active measures towards compliance in this area. However, having run this by management along with the costs they have questioned the need for this. I would be really interested in other peoples thoughts on this please?Thanks

[GrumbleDook]

Have a look at the NCSC site for Cyber Essentials and Cyber Essentials Plus.

 

Definitely worth it.

[Simcfc73]

We use SEC-1. Really good company and local to us to we were happy to use them

 

They did say the CE+ is different from last year so instead of 3 base machines they want 13 so its a 3 day visit this year.

 

 

££££ is tight but its worth it.