Penetration Testing for CBRT-Licensed Payment and E-Money Institutions

The Communiqué on the Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in the Field of Payment Services was published in Official Gazette No. 31676 on 1 December 2021.

It governs the management of payment and e-money institutions' information systems, their audit by authorized independent audit firms, and data sharing services.

• Frequency and scope: information systems undergo scenario-based penetration testing covering internal and external threats at least once a year.
• Who tests: natural or legal persons with no role in meeting information security requirements who hold a national or international penetration testing certification.
• Method: tests follow the procedures in Annex EK-5 of the Communiqué.
• Remediation: priority findings are remediated as soon as possible under a board-approved action plan.
• Reporting: test results, critical vulnerabilities and their remediation status are reported to the Central Bank at least once a year.

We clarify with you, at the proposal stage, the certification and competence requirements the regulation sets for the testing provider.

Penetration testing is distinct from the independent information systems audit regulated separately in the Communiqué; we cover the penetration testing side.

• Penetration testing of payment pages, mobile wallet apps, APIs and merchant integrations.
• Internal and external network scenarios and, where needed, social engineering tests.
• A risk-classified report that feeds your action plan and CBRT reporting.
• Retesting after remediation and a closure record.