thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

NIST SP 800-115

NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.

Definition

SP 800-115 describes a four-phase assessment process of planning, discovery, attack and reporting, with discovery and attack forming a loop. It groups techniques into review techniques, target identification and analysis, and target vulnerability validation. US federal agencies and contractors commonly reference it.

Example

A federal contractor documents that its annual assessment followed the NIST SP 800-115 planning-discovery-attack-reporting model.

Exam tip

Remember the four phases: planning, discovery, attack, reporting, and that attack can loop back into discovery.

Related terms