11.4.4External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected

Defined Approach Requirements:

Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected as follows:

- In accordance with the entity's assessment of the risk posed by the security issue as defined in Requirement 6.3.1.

- Penetration testing is repeated to verify the corrections.

Defined Approach Testing Procedures:

11.4.4 Examine penetration testing results to verify that noted exploitable vulnerabilities and security weaknesses were corrected in accordance with all elements specified in this requirement.