Key Facts
- Regulator
- National Institute of Standards and Technology (NIST), Computer Security Division, Information Technology Laboratory (US Department of Commerce)
- Latest version
- NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment (final, September 2008). The CSRC page lists no later revision.
- Effective
- 30 September 2008
- Official text
- csrc.nist.gov ↗
What is NIST SP 800-115?
NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment, is a guide from the US National Institute of Standards and Technology on planning and running technical security tests, analysing findings and developing mitigation strategies. It is prepared for US federal agencies, and other organisations may use it voluntarily.
The current version is the final edition published in September 2008 (dated 30 September 2008 in the document history on the NIST CSRC page). That page lists no later revision. NIST SP 800-115 supersedes NIST SP 800-42. It comes from NIST's Computer Security Division, part of the Information Technology Laboratory.
The guide is deliberately narrow. It gives an overview of key technical techniques, with their benefits and limitations. It says plainly that it is not a comprehensive testing or assessment programme. Organisations use it to find vulnerabilities and to verify compliance with a policy or other requirements.
A penetration test is not a control. It is a check on whether your controls work.
Why it matters
A buyer asks how your penetration testing is scoped, run and reported. A testing firm's proposal cites a methodology you have never read. Without a shared reference, you are negotiating scope by guesswork.
NIST SP 800-115 is a public reference for that conversation. It sets out what a test plan contains, which techniques exist and what a finding should lead to.
It is one methodology among several. The guide itself points to the Open Source Security Testing Methodology Manual (OSSTMM) as another widely used one, and NIST does not endorse one over another.
Who it applies to
The guide is written for security staff and programme managers, system and network administrators, and other technical staff.
The obligation depends on who you are:
- US federal agencies: it is prepared for them, and it supports their FISMA-driven testing duties.
- Everyone else: it is voluntary. NIST publishes the guidance, but it is not a certifiable standard, so there is no certificate to hold and no audit against it.
Within NIST's own set, SP 800-53A is the method for assessing the security controls in SP 800-53. NIST SP 800-115 supplies technical test techniques that can serve that method or any other.
For an ISO 27001 holder, NIST SP 800-115 is a technique reference, not a rival framework. It can shape how you design and report the technical tests behind A.8.8, management of technical vulnerabilities.
The UK position
No UK law names NIST SP 800-115, and the guide has no UK legal standing. UK firms use it as a methodology reference, often because a testing supplier or a US customer cites it.
The UK equivalent is the NCSC's penetration testing guidance. It covers commissioning, scoping, testing, reporting and following up a test. The NCSC frames penetration testing as a method for gaining assurance in your organisation's vulnerability assessment and management processes, which matches the position of NIST SP 800-115.
For UK government (HMG) work, the NCSC recommends testers and companies from the CHECK scheme. The CHECK scheme is not part of NIST SP 800-115.
Key requirements
NIST SP 800-115 is guidance, so its "requirements" are the structure it recommends. It has three parts a reader can use.
Three groups of technique
The guide groups technical techniques into three categories:
- Review techniques. Mostly manual checks of documents, logs, rulesets and system settings that look for weaknesses in systems, networks, policies and procedures.
- Target identification and analysis techniques. Techniques, usually automated, that find systems, ports, services and possible vulnerabilities, such as network discovery and vulnerability scanning.
- Target vulnerability validation techniques. Techniques that confirm a vulnerability really exists, such as password cracking and penetration testing.
A phased assessment
The guide recommends a phased methodology with, at minimum, planning, execution and post-execution phases.
Planning carries much of the weight. The guide asks for each assessment to be covered by an assessment plan, whatever the scope, level of intrusiveness or party performing the test. Planning covers:
- an assessment policy;
- prioritisation and scheduling;
- selection of techniques;
- logistics;
- the assessment plan or rules of engagement;
- legal considerations.
Penetration testing phases
Penetration testing has its own four phases: planning, discovery, attack and reporting. The attack phase can loop back to discovery as new targets appear. Reporting runs alongside the other phases rather than waiting until the end.
A test with no agreed rules of engagement is not a test. It is an incident you invited.
Frequently asked questions
NIST SP 800-115 is voluntary for non-government organisations. Its intended users are US federal agencies: FISMA requires them to test the effectiveness of their security policies, procedures and practices at least once a year, and NIST wrote the guide under its FISMA duties. For anyone else it becomes binding only if a contract or internal policy adopts it.
No. NIST SP 800-115 is guidance, not a certifiable standard, and NIST does not audit or certify organisations against it. You can show that your testing follows its structure through your assessment plans, rules of engagement, test reports and the remediation records that follow.
Partly. NIST SP 800-115 includes a four-phase penetration testing methodology: planning, discovery, attack and reporting. But it covers wider ground, including review techniques, target identification and analysis, and vulnerability validation. It is an overview of techniques, not a full penetration testing programme.
The current version of NIST SP 800-115 is the final edition of September 2008, and the NIST CSRC page lists no later revision. It replaced SP 800-42, Guideline on Network Security Testing, from 2003. Its tool examples, such as the BackTrack toolkit in Appendix A, date from 2008, so treat them as illustrations rather than current advice.
NIST SP 800-53A is NIST's method for assessing whether the security controls in SP 800-53 are effective. NIST SP 800-115 names it as one example of an assessment methodology, alongside OSSTMM, and supplies technical testing and examination techniques that can serve either. NIST does not endorse one methodology over another, so SP 800-115 does not require you to use SP 800-53A.
No UK law requires NIST SP 800-115. UK GDPR Article 32 does ask for a process to regularly test, assess and evaluate how well security measures work, but it names no method. NIST SP 800-115 is one methodology a UK firm can cite for that testing. For UK government work, the NCSC's guidance and the CHECK scheme are the references.