Independent Cyber Testing and Evidence: Cyber Liability Essentials and Cyber Watch

A penetration test, often shortened to pen test, is an authorized, simulated attack on your systems that tries to exploit weaknesses the way a real attacker would, then documents what was reached and how. The National Institute of Standards and Technology (NIST) describes it as mimicking real-world attacks to get around security features. It proves exploitability, not just exposure.

How it is used:

• Cyber insurance application: answering whether, and how often, an independent party tests your network, with the date of the latest report.
• Customer security questionnaire: showing a recent third-party test when a client asks how you protect their data.
• Before a big change: testing new remote access or a cloud move before the business relies on it.

A vulnerability scan is an automated check of computers, servers, network devices and internet-facing systems against databases of publicly known weaknesses and misconfigurations. It produces a list of potential issues ranked by severity. A scan does not try to exploit what it finds, so it shows where risk may exist, not whether an attacker could use it.

How it is used:

• Routine hygiene: monthly scans find missing patches and risky settings so IT can fix them between pen tests.
• Compliance review: some rules, such as the FTC Safeguards Rule for covered businesses, call for scheduled vulnerability assessments.
• Newly published threat: a fresh scan shows whether any of your systems run the affected software.

An external penetration test starts from the internet with no inside access, the way an outside attacker would. It targets what the public can reach, such as your website, remote access and virtual private network (VPN) portals, email services and exposed devices. The goal is to learn whether someone outside could gain an initial foothold.

How it is used:

• After a firewall or internet change: confirming nothing new was left exposed.
• Insurance questions about internet-facing systems: showing those systems were tested by someone independent.
• Contracts: answering a customer clause that asks whether your perimeter has been tested.

An internal penetration test assumes an attacker already has a foothold inside, for example through a compromised laptop or vendor tool. It measures how far that attacker could move: escalating privileges, reaching file servers or Microsoft 365 data, and hopping between systems. It tests segmentation, permissions and detection behind the firewall.

How it is used:

• Protecting sensitive departments: checking whether one infected laptop could reach finance or HR files.
• Vendor and guest access: confirming guest Wi-Fi and vendor connections are separated from business systems.
• After staff changes: proving old administrator rights were really removed.

A social engineering test checks how people, not just systems, respond to manipulation. The most common form is a simulated phishing email sent to staff with leadership's approval, measuring who clicks or reports it. Cyber Watch does not include phishing simulations; BTI provides them through its separate email security and security awareness training service.

How it is used:

• Training: comparing results before and after awareness training to see what changed.
• Insurance application: supporting answers about how often staff receive phishing training.
• Where it lives at BTI: phishing simulations and training are part of email security and security awareness training, not Cyber Watch.
• Payment fraud: rehearsing how finance staff verify a request to change bank details.

An attack path, also called an attack chain, is the sequence of weaknesses an attacker links together to reach a goal, for example a reused password that opens a workstation, then an over-privileged account, then sensitive files. Testing that validates attack paths shows which single fix breaks the chain, often more useful than a long list of findings.

How it is used:

• Prioritizing fixes: removing one stale administrator account may close several findings at once.
• Leadership briefings: explaining risk as a story an executive can follow.
• Vendor risk: showing what happens if a trusted vendor tool becomes the way in.

Credential-free testing starts without usernames, passwords or administrator rights supplied by the client, so results reflect what an attacker could do from a realistic starting point. Cyber Watch testing activates safely this way. It differs from authenticated scanning, which logs in to systems to read deeper configuration detail, and both approaches have a place.

How it is used:

• Realistic view: seeing your environment the way an intruder would.
• Less exposure: testing without handing administrator passwords to an outside party.
• Paired with scans: authenticated scans then fill in patch and configuration detail.

Remediation is fixing a finding by patching, changing a configuration, removing access or adding a control. A retest repeats the original attack path to confirm the fix actually closed it. Together they turn a report into evidence: the finding, the action taken, and proof that the weakness can no longer be exploited.

How it is used:

• Before renewal: closing high-risk findings and keeping the retest as proof.
• Customer follow-up: showing a client that an issue from a prior test is resolved.
• Trend reporting: counting fixed and retested findings quarter over quarter.

A WISP, short for written information security program, is the documented set of policies, roles and safeguards an organization uses to protect sensitive information. Some guidance, including the IRS, calls it a written information security plan. It typically names a responsible person and covers risk assessment, access control, training, vendor oversight and incident response.

How it is used:

• Cyber insurance application: answering "do you have written information security policies?" and producing the document if the carrier asks.
• Client or vendor security questionnaire: attaching or summarizing your WISP when a customer reviews you as a vendor.
• Regulator or compliance review: the FTC Safeguards Rule requires covered businesses to keep their information security program in writing, and IRS Publication 5708 guides tax and accounting practices through creating one.
• Internal staff policy: the source for onboarding training and the policies employees acknowledge each year.

An incident response plan, or IR plan, is a written playbook for what your organization does when a security event happens: who leads, who decides, who gets called, how systems are contained and restored, and how customers, insurers and authorities are notified. National Institute of Standards and Technology (NIST) guidance treats incident response as part of ongoing risk management.

How it is used:

• During an incident: staff know who to call first, including your insurer under your policy's notice terms.
• Insurance application: answering whether you have a written plan and when it was last reviewed.
• Customer contracts: meeting clauses that require you to notify clients of a breach.
• Leadership practice: walking through a scenario with executives so the plan is familiar before it is needed.

An evidence locker is a secure, central place for the records that prove your security program exists and is maintained: policies, training completions, policy acceptances, test reports, retest results and risk decisions. Cyber Liability Essentials includes an evidence locker for your compliance program, if you have one, on a portal that stays reachable when your systems are down.

How it is used:

• Renewal: pulling training records and policy acceptances in minutes instead of days.
• Audit or compliance review: handing a reviewer dated records rather than rebuilding them.
• After an incident: showing counsel and your insurer the reasonable steps you took beforehand.

A risk assessment identifies the sensitive information and systems you have, the threats to them, how likely and damaging each threat is, and which controls reduce the risk. It is usually written and repeated periodically or after major changes. Cyber Watch includes an annual risk assessment engine that feeds your WISP and security plan.

How it is used:

• Regulation: the FTC Safeguards Rule requires covered businesses to keep a written risk assessment.
• Budgeting: ranking which security projects reduce the most risk per dollar.
• WISP updates: deciding what to change in your written program each year.

A risk acceptance is a documented decision by leadership not to fix, or to delay fixing, a known finding, with the reason, the owner and a review date. Recording it shows the risk was understood and consciously managed rather than ignored. In a BTI program, declined recommendations are recorded in your governance, risk and compliance (GRC) program.

How it is used:

• Legacy systems: a machine that cannot be patched until it is replaced next year.
• Budget timing: a fix scheduled for the next fiscal year, with a date to revisit.
• Audits: showing a reviewer a decision was made on purpose, by the right person.

GRC, short for governance, risk and compliance, is the practice and set of tools an organization uses to set security policy, track risks and decisions, and show that it meets the rules and contracts that apply to it. A GRC program connects policies, risk registers, vendor reviews and evidence in one place.

How it is used:

• Risk register: tracking open risks, owners and due dates.
• Compliance mapping: showing which controls satisfy which framework or contract clause.
• Vendor risk: recording reviews of vendors that handle your data.

MFA, short for multi-factor authentication, is a sign-in method that requires two or more different kinds of proof: something you know, such as a password; something you have, such as a phone app or security key; or something you are, such as a fingerprint. It blocks many attacks that rely on stolen passwords.

How it is used:

• Email: requiring a second factor for Microsoft 365 sign-in.
• Remote access and administrator accounts: two areas cyber insurance applications commonly ask about.
• Regulation: the FTC Safeguards Rule requires MFA for anyone accessing customer information at covered businesses. CISA recommends the strongest forms of MFA, such as security keys, where possible.

An MFA attestation is a written statement, often part of an insurance application or renewal, confirming where multi-factor authentication (MFA) is enforced, such as email, remote access and administrator accounts. Because it is a representation of fact, it should match your actual settings. A documented MFA settings review is the evidence behind the answer.

How it is used:

• New policy or renewal: answering MFA questions accurately, with exceptions listed.
• Customer questionnaire: confirming MFA coverage to a client reviewing you as a vendor.
• Internal check: comparing the attestation against the latest Microsoft 365 MFA settings analysis.

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) are email authentication records published in your domain's DNS (Domain Name System). Together they let receiving mail servers check that a message claiming to come from your domain is genuine, and tell them what to do when it is not.

How it is used:

• Fraud prevention: making it harder for criminals to send fake invoices that appear to come from your domain.
• Insurance application: supporting answers about email security controls.
• Deliverability: major mailbox providers expect bulk senders to authenticate their mail.

Cyber liability insurance is coverage that can help pay costs from a cyber incident, such as investigation, data restoration, notification, business interruption and legal claims, depending on the policy. Carriers typically ask about your security controls on the application, and the accuracy of those answers can matter if you later file a claim.

How it is used:

• After a breach: helping fund forensic investigation and customer notification, depending on the policy.
• Customer contracts: some clients require vendors to carry cyber coverage.
• Downtime: business interruption coverage, where the policy includes it.

A NOC, or network operations center, monitors the health, availability and performance of networks and systems. A SOC, or security operations center, monitors for threats, investigates alerts and coordinates response. BTI's 24/7 NOC/SOC means both kinds of monitoring run around the clock, including nights, weekends and holidays.

How it is used:

• After hours: a suspicious sign-in at 2 a.m. is investigated, not left for Monday.
• Outages: a failed device or circuit is spotted before staff arrive.
• Insurance and customer questions: answering who monitors your environment and when.

A vCISO, short for virtual chief information security officer, is an outside senior security leader who provides security strategy, risk decisions and leadership reporting on a part-time or shared basis. It suits organizations that need executive-level security guidance without a full-time hire. BTI's vCISO reviews Cyber Watch trends with your leadership.

How it is used:

• Board and leadership updates: explaining test results and trends in business terms.
• Program ownership: keeping the WISP, risk register and risk acceptances current.
• Regulation: the FTC Safeguards Rule lets a service provider fill its Qualified Individual role, with a senior employee overseeing that person.

A VPN, short for virtual private network, is an encrypted connection that lets remote users or offices reach internal systems over the internet as if they were on the local network. Because it is a doorway into the business from outside, it is a common target for attackers and a common focus of external testing.

How it is used:

• Remote work: staff reach file shares and business applications from home.
• External pen test: VPN portals are checked for weak settings and unpatched software.
• Insurance application: carriers commonly ask whether MFA is required for remote access.

The FTC Safeguards Rule is the Federal Trade Commission's Standards for Safeguarding Customer Information. It requires covered non-bank financial businesses, such as tax preparation firms, mortgage brokers and finance companies, to keep a written information security program with risk assessment, safeguards like MFA, testing, staff training, vendor oversight and incident response planning.

How it is used:

• Tax and accounting practices: building a WISP that meets the rule.
• Testing schedule: the rule calls for annual penetration testing and vulnerability assessments every six months unless the business runs continuous monitoring.
• Breach reporting: covered businesses must notify the FTC within 30 days of discovering a breach involving 500 or more consumers' unencrypted information.

PCI DSS, the Payment Card Industry Data Security Standard, is the security standard set by the PCI Security Standards Council for organizations that store, process or transmit payment card data. It covers network security, access control, vulnerability management, testing and monitoring. Card brands and payment processors enforce it through their merchant agreements.

How it is used:

• Merchants: retailers, restaurants and other businesses that accept cards complete an annual assessment or questionnaire.
• Scoping: separating the systems that touch card data from the rest of the network.
• Compliance mapping: Cyber Watch can map your controls to frameworks such as PCI.

SOC 2, short for System and Organization Controls 2, is an attestation framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm reports on a service organization's controls for security, availability, processing integrity, confidentiality and privacy. Customers often request SOC 2 reports from software and service vendors.

How it is used:

• Vendor reviews: a customer asks a software or service provider for its SOC 2 report.
• Readiness: organizations preparing for a SOC 2 examination map their controls to its criteria.
• Compliance mapping: Cyber Watch can map your controls to frameworks such as SOC 2.

ISO 27001, formally ISO/IEC 27001 from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), is the international standard for an information security management system: the policies, risk processes and continual improvement an organization uses to manage security. BTI's operational governance is ISO 27001 compliant and independently reviewed.

How it is used:

• International or enterprise customers: a common reference point in vendor security reviews.
• Program structure: a model for organizing policies, risk assessment and improvement cycles.
• Choosing providers: a signal that a provider's own governance follows a recognized standard.

NIST, the National Institute of Standards and Technology, is a U.S. Department of Commerce agency that publishes widely used cybersecurity guidance, including the NIST Cybersecurity Framework and Special Publications (SP) on testing and incident response. Its guidance is voluntary for most private businesses but is a common reference point.

How it is used:

• Testing method: NIST SP 800-115 describes how security testing and assessment are planned and run.
• Incident response: NIST SP 800-61 guides how organizations prepare for and handle incidents.
• Program planning: the Cybersecurity Framework gives leadership a common language for security goals.

CISA, the Cybersecurity and Infrastructure Security Agency, is the U.S. federal agency that leads national efforts to understand and reduce cyber risk. It publishes free guidance, alerts and resources for organizations of all sizes, including the Known Exploited Vulnerabilities (KEV) catalog of flaws that attackers are actively using.

How it is used:

• Patch priorities: fixing vulnerabilities on the KEV catalog ahead of others.
• MFA guidance: CISA recommends the strongest forms of MFA, such as security keys, where possible.
• Alerts: tracking current threats that may affect your systems.

GSA, the U.S. General Services Administration, is the federal agency that manages government buying programs, including the Multiple Award Schedule that federal agencies use to purchase products and services from pre-approved contractors. BTI is a GSA contract holder (47QTCA21D00BA), which lets eligible government buyers purchase through that contract vehicle.

How it is used:

• Federal agencies: buying from a contract that has already been competed and approved.
• Procurement review: confirming a vendor's contract number before purchase.

CMAS, short for California Multiple Award Schedules, is a California Department of General Services program that state and local government agencies in California can use to purchase products and services, including IT, from contractors whose pricing and terms were already established. BTI is a CMAS and TESMA contract awardee (California).

How it is used:

• California public agencies: purchasing through an existing schedule instead of a new bid.
• Procurement review: confirming the contractor holds an active award.

TESMA, short for Telecommunications Equipment and Services Master Agreement, is a master agreement administered by the County of Los Angeles Internal Services Department. It gives county departments a pool of prequalified providers for telecommunications equipment and services, including installation and maintenance of voice, data network and related systems.

How it is used:

• Los Angeles County departments: obtaining telecommunications equipment and services from prequalified vendors.
• Project bids: work is competed among prequalified contractors project by project.

CSV, short for comma-separated values, is a plain-text file format that stores a table as rows of values separated by commas. Spreadsheet programs such as Excel open and save it. In Cyber Liability Essentials and Cyber Watch, your user list can be imported from Microsoft 365, a CSV file or Excel.

How it is used:

• Onboarding: importing your staff list so training and policy acceptance can be tracked.
• Updates: adding new hires in bulk.