{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43595,"path":"security-management/application-vulnerability-response/pen-test-create-from-list.md","title":"Create a penetration test assessment request from existing requests \\(v19.0\\)","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create a penetration test assessment request from existing requests \\(v19.0\\)\n\nStarting with v19.0, you create penetration test assessment requests directly from the list of existing requests. You can also copy existing requests in the Closed state on this list to create requests.\n\n## Before you begin\n\nRole required: Application Owner\n\n## About this task\n\nStarting with v19.0 of Vulnerability Response, if you are using the Veracode Vulnerability Integration, the penetration assessment tests in the Veracode Vulnerability Integration are manual findings from Veracode. They are not linked to any penetration test assessment requests you configure in Application Vulnerability Response. For more information about penetration test assessments from Veracode, see the [Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-vuln-integration.md).\n\n## Procedure\n\n1. Navigate to **All** > **Penetration Test Assessment Requests** > **All**.\n\n2. Alternatively, you can create a request by replicating closed requests.\n\n All the values from the original request are preserved in the new form. Active application vulnerable items \\(AVIs\\) are automatically copied to the new request. Select **Copy And Create Request** from records in the Closed state.\n\n3. Select New and fill out the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nNumber\n\n\n\nUnique identifier generated for the penetration test assessment request.\n\n
\n\nState\n\n\n\nSelect a value based on the status of the request.\n\n
\n\nRequested by\n\n\n\nPerson requesting the assessment of the application.\n\n
\n\nAssignment group\n\n\n\nGroup selected to work on the penetration test findings. Can be manually added or edited by an App-Sec Manager.To configure groups, see [Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.md).\n\n
\n\nApplication\n\n\n\nSelect an application using the search option.\n\n
\n\nAssigned to\n\n\n\nIndividual from the selected assignment group that works on the penetration test findings. Can be manually added or edited by an App-Sec Manager.\n\n
\n\nApplication type\n\n\n\nSelect an option from:- Web service \\(known as API prior to v16.1\\)\n- Web Application\n- Thick Client\n- Mobile \\(If you select **Mobile**, the Mobile tab is displayed at the bottom of the form with additional fields\\)\n\n\n
\n\nSprint\n\n\n\nDisplays the sprints with bandwidth available to accommodate the assessment request based on the selected Assessment type field.See [Configure sprints for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-sprints.md) and [Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.md) for more information about modifying sprint capacity and testing scope.\n\n
\n\nv19.0: Application size\n\n\n\nSelect the size of the application you want to test.- Small\n- Medium\n- Large\n- Standard \\(select this option if you are not sure of the size\\)\nSee more [Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.md) more information about modifying sprint capacity and testing scope with application size and sprint capacity.\n\n
\n\nCreated\n\n\n\nDate and time the request was created.\n\n
\n\nAssessment type\n\n\n\nSelect the type of assessment from:- Full penetration Test\n- Focused Test\n- Re-test\nFor more details about testing combinations and testing scope, see [Configure assessment types for penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-assessment-types.md).\n\n
\n\nUpdated\n\n\n\nDate and time the request was last updated.\n\n
\n\nDemo date\n\n\n\nDate when this application can be demonstrated.\n\n
\n\nProduct deployment planned on\n\n\n\nPlanned date to deploy this application in production.\n\n
\n\nApplication version/release planned for deployment\n\n\n\nVersion of the application planned for production deployment.\n\n
\n\nv19.0: Application owned by third-party vendor or a joint venture tabIf you select Yes for this field, the Vendor/ Joint Venture Information tab is displayed. Fill in the additional fields.\n\n
\n\nClause exists that enables us to perform pen testing?\n\n\n\nThe term 'Clause' might refer to standards for testing that include any agreements that exist between two or more parties you want to add. If you select **Yes**, add the clause.\n\n
\n\nThe clause citing the permission to perform pen testing\n\n\n\n \n\n
\n\nFull legal name and address of the vendor\n\n\n\n \n\n
\n\nIntrusion detection system\n\n\n\n \n\n
\n\nTechnical contact from vendor\n\n\n\n \n\n
\n\nHas the logged information been reviewed form malicious activity?\n\n\n\n \n\n
\n\nApplication hosted by another third-party vendor?\n\n\n\n \n\n
\n\nContact from vendor who will be signing off on the pen test\n\n\n\n \n\n
\n\nApplication Details tab\n\n
\n\nPurpose of application\n\n\n\nDescription of the application’s functionality.\n\n
\n\nTechnology stack details\n\n\n\nComplete technology stack from front end to back-end, databases, and other key technologies.\n\n
\n\nIs third-party application?\n\n\n\nConfirms if this application is owned by a third-party vendor.\n\n
\n\nList types of sensitive data accessible from application\n\n\n\nTypes of sensitive data accessible from the application. For example, PII data, PHI data, and financial data such as credit card numbers.\n\n
\n\nAuthentication type\n\n\n\nSpecifies if this application uses LDAP authentication, its own native authentication, or other forms of authentication.\n\n
\n\nIs application in scope for any compliance program?\n\n\n\nSpecifies if this application impacts any compliance programs such as PCI.\n\n
\n\nApplication team contacts\n\n\n\nMembers of the application team to be contacted by the ethical hacking team for any questions.\n\n
\n\nList of compliance programs\n\n\n\n \n\n
\n\nRelated third-party interfaces or applications\n\n\n\n \n\n
\n\nIP address\n\n\n\n \n\n
\n\nApproximate number of users in production?\n\n\n\n \n\n
\n\nAutomated script exists?\n\n\n\n \n\n
\n\nProduction version of this app is external-facing?\n\n\n\n \n\n
\n\nv 19.0: Business Impact\n\n
\n\nFinancial damage\n\n\n\nSelect one from the list.\n\n
\n\nNon-compliance\n\n\n\nSelect one from the list.\n\n
\n\nReputation damage\n\n\n\nSelect one from the list.\n\n
\n\nPrivacy violation\n\n\n\nSelect one from the list.\n\n
\n\nTesting details tab\n\n
\n\nURLs to test\n\n\n\nURLs that must be included in penetration testing.\n\n
\n\nURLs to exclude\n\n\n\nURLs that must be excluded from penetration testing.\n\n
\n\nWas this application tested previously?\n\n\n\nSpecifies if this application has already been penetration tested.\n\n
\n\nReason for retest\n\n\n\nReason for asking for a penetration test reassessment if the application was tested earlier.\n\n
\n\nWhen was the application tested?\n\n\n\nTime frame when the application was penetration tested.\n\n
\n\nTest account details\n\n\n\nDetails of the test account that can be used by ethical hacking team for penetration testing.\n\n
\n\nApplication roles\n\n\n\nRoles supported by the application for its users.\n\n
\n\nMost used roles\n\n\n\nMost commonly used roles in the application.\n\n
\n\nAdditional Comments tab\n\n\n\n \n\n
\n\nWork notes\n\n\n\n \n\n
4. Select **Save** to save your edits or **Submit** to initiate the request.\n\n\n"}}