Compliance
The right test for your audit.
Tell us your framework and we'll scope testing that produces the evidence auditors ask for.
PhishRoot test reports are designed to support audit evidence. PhishRoot does not hold or grant any certification, and passing a test does not make you compliant.
PCI DSS 4.0
Organisations that store, process or transmit card data.
Requirement 11.4 calls for internal and external penetration testing at least annually and after significant changes, plus segmentation testing.
Typical tests
SOC 2
SaaS and service providers handling customer data.
Auditors commonly expect evidence of independent security testing to support the Security trust services criteria.
Typical tests
ISO/IEC 27001:2022
Organisations operating an ISMS.
Annex A controls on technical vulnerability management and secure development are often supported with penetration-test evidence.
Typical tests
PIPEDA & Quebec Law 25
Canadian organisations handling personal information.
Requires safeguards appropriate to the sensitivity of the data; testing shows whether those safeguards hold up.
Typical tests
HIPAA
US healthcare providers and their business associates.
The Security Rule's risk-analysis and evaluation requirements are commonly supported with technical testing.
Typical tests
DORA & NIS2
EU financial entities and essential service operators.
Require regular resilience testing; DORA adds threat-led penetration testing for significant entities.
Typical tests