NIST SP 800-115 Security Testing & Assessment
NIST SP 800-115 describes how to plan and run technical security assessments: review techniques, target identification and analysis, and target vulnerability validation (penetration testing). Many contracts and audit regimes ask for testing “in line with NIST 800-115”.
Mutex Systems follows its four-phase model — planning, discovery, attack and reporting — alongside PTES and OWASP, and states this in every report.
- Category
- Testing Methodology
- Jurisdiction
- United States
- Issuing Body
- NIST (US National Institute of Standards and Technology)
- Current Version
- SP 800-115 (2008) — still the reference NIST testing guide
- Who It's For
- Organisations whose customers, auditors or regulators require a recognised testing methodology — US-facing businesses, FedRAMP and SOC 2 environments, and public-sector suppliers.
Core Domains
A Practical Engagement Path
- 01
Planning
Scope, rules of engagement, authorisation and data-handling rules.
- 02
Discovery
Identify systems, services and candidate vulnerabilities.
- 03
Attack
Validate vulnerabilities by safe exploitation and privilege escalation.
- 04
Reporting
Findings, impact and prioritised mitigation.
A defensible, documented method
Every engagement records scope, authorisation and evidence so the result stands up to audit.
- Written rules of engagement
- Evidence for every finding
- Methodology statement referencing NIST, PTES and OWASP
Assessment results as audit evidence
Assessment findings flow into grComply, map to NIST CSF, NIST SP 800-53 and ISO 27001 controls, and keep a history of retests.
- Findings from code, web app, API, cloud, Kubernetes and network scans in one findings list
- Each finding mapped to its technical benchmark and to the controls of every framework you hold
- High-risk findings raised straight into the risk register with an owner and due date
- Retest results recorded as evidence, so auditors see the fix, not just the finding
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About NIST SP 800-115
Is NIST SP 800-115 out of date?
It was published in 2008, but its phases and planning guidance remain the standard reference. We combine it with current methods such as PTES, OWASP and MITRE ATT&CK.
Is NIST 800-115 mandatory?
Not by law, but US federal environments and many contracts require testing that follows it.
Ready to Start Your NIST SP 800-115 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.