These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Penetration Test Management
- Data model
The tables behind Penetration Test Management
Penetration Test Management ships with 12 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 12
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Engagement scopes and findings
Engagement scopes holds client authorization and the testing window. Security findings links each affected asset and its evidence to that scope.
Inspection review
Inspections contains the assigned subject and lifecycle. Inspection checks records each requirement result. Nonconformances links back to the inspection.
Correction
Corrective actions links root cause, owner, due date and effectiveness state to Nonconformances.
Audit and documents
Audits links to audit findings; controlled documents links to training acknowledgments.
People and access
People links assigned work and acknowledgments to Users.
Every table, by feature
- Engagement scopes1
- Security findings2
- Inspections and checks3
- Disposition and corrective actions5
- Audits and findings3
- Controlled documents3
- Shared and settings1
- Engagement scopes
Authorized penetration testing engagements with client, authorized targets, window and authorization document.
- Security findings
Security findings discovered during an engagement, tracked from open through remediation, retest and closure.
Linked to Engagement scopes - Engagement scopes
Authorized penetration testing engagements with client, authorized targets, window and authorization document.
- Inspections
Scheduled and completed inspections with type, assignee and lifecycle status.
Linked to People - Inspection checks
Individual requirement checks captured against an inspection, with observation, result and evidence.
Linked to Inspections - People
Team members who perform inspections, own corrective actions, audit and acknowledge controlled documents.
Linked to Users
- Inspections
Scheduled and completed inspections with type, assignee and lifecycle status.
Linked to People - Inspection checks
Individual requirement checks captured against an inspection, with observation, result and evidence.
Linked to Inspections - Nonconformances
Nonconformances raised from failed inspection checks, with severity and disposition status.
Linked to Inspections - Corrective actions
Root cause and corrective action plans owned by a person, tracked through effectiveness review.
Linked to Nonconformances, People - People
Team members who perform inspections, own corrective actions, audit and acknowledge controlled documents.
Linked to Users
- Audits
Planned and completed audits with scope, auditor and reporting status.
Linked to People - Audit findings
Findings raised against an audit requirement, with severity, owner and due date.
Linked to Audits, People - People
Team members who perform inspections, own corrective actions, audit and acknowledge controlled documents.
Linked to Users
- Controlled documents
Versioned controlled documents with effective dates and approval status.
- Training acknowledgments
Per-person acknowledgment of a controlled document version.
Linked to Controlled documents, People - People
Team members who perform inspections, own corrective actions, audit and acknowledge controlled documents.
Linked to Users
Keys and references
Keep the engagement reference on a security finding, the inspection reference on each check and issue, and the issue reference on each corrective action. Preserve the audit reference on an audit finding and the document and person references on an acknowledgment. The inspection number and audit number help people identify work; the record references preserve the actual link.
Migration order
- People and access. Prepare Users and People so assignments and acknowledgment references resolve.
- Parent records. Bring in engagement scopes, Inspections, Audits and controlled documents with the agreed identifiers and dates.
- Working evidence. Add security findings, inspection checks and audit findings with their parent links.
- Follow-up work. Add Nonconformances, corrective actions and training acknowledgments after their referenced records exist.
- Reconcile. Sample records across each link and check the owner, status, attachment and date fields before use.
Set up Penetration Test Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.