Requirement
[A: M | B: R] Cybersecurity requirements for penetration testing must be defined, documented and approved, and at minimum the penetration-test scope must include all externally provided services (via the Internet) and their technical components — including infrastructure, websites, web applications, mobile applications, email and remote access.
