{"id":7300,"date":"2026-10-18T11:57:48","date_gmt":"2026-10-18T09:57:48","guid":{"rendered":"https:\/\/mu.it-cyberwall.com\/guides\/audit-vulnerability-scan-or-penetration-test-what-to-order\/"},"modified":"2026-10-18T20:09:04","modified_gmt":"2026-10-18T18:09:04","slug":"audit-scan-test-intrusion","status":"publish","type":"page","link":"https:\/\/mu.it-cyberwall.com\/en\/guides\/audit-scan-test-intrusion\/","title":{"rendered":"Audit, vulnerability scan or penetration test: what to order"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"7300\" class=\"elementor elementor-7300 elementor-6677\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"page\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d6b23bd elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d6b23bd\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-4847607\" data-id=\"4847607\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2517b80 elementor-widget elementor-widget-html\" data-id=\"2517b80\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t\t<style>.itcw-g{max-width:900px;margin:0 auto;font-size:17px;line-height:1.65;color:#2b2f3a}.itcw-g h2{margin-top:10px}.itcw-g .tw{overflow-x:auto;margin:18px 0}.itcw-g table{width:100%;border-collapse:collapse;font-size:15px;min-width:640px}.itcw-g th,.itcw-g td{border:1px solid #e3e6ee;padding:10px 12px;vertical-align:top;text-align:left}.itcw-g thead th{background:#0E0129;color:#fff}.itcw-g tbody th{background:#F6F7FA;font-weight:600}.itcw-g .box{background:#F6F7FA;border-left:4px solid #DE3241;padding:16px 20px;border-radius:6px;margin:18px 0}.itcw-g .box.ok{border-left-color:#2C9703}.itcw-g sup a{text-decoration:none;font-weight:600}.itcw-g ol.src li{margin-bottom:8px;font-size:15px;word-break:break-word}.itcw-g .note{font-size:14px;color:#6b7080}.itcw-g .toc a{display:inline-block;margin:4px 10px 4px 0}<\/style>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-090f00e elementor-widget elementor-widget-heading\" data-id=\"090f00e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">Guide<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a49fd4e elementor-widget elementor-widget-heading\" data-id=\"a49fd4e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Audit, vulnerability scan or penetration test: what to order<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3fe4617 elementor-widget elementor-widget-text-editor\" data-id=\"3fe4617\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><p style=\"text-align:center\">An automated scan lists likely flaws, an audit ranks them and tells you what to fix, and a penetration test proves what an attacker could do with them. Here are the ANSSI definitions, what a report should contain, and what the GDPR and ISO 27001 really require.<\/p><p class=\"note\" style=\"text-align:center\">Updated on 18 October 2026 \u00b7 Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7a65bc8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7a65bc8\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-53b09af\" data-id=\"53b09af\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8802df8 elementor-widget elementor-widget-text-editor\" data-id=\"8802df8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><div class=\"box toc\"><strong>Contents:<\/strong><br \/><a href=\"#trois\">Three services that get confused<\/a> \u00b7 <a href=\"#types\">The five types of audit according to ANSSI<\/a> \u00b7 <a href=\"#rapport\">What the report should contain<\/a> \u00b7 <a href=\"#loi\">What the law requires, and what it does not<\/a> \u00b7 <a href=\"#autorisation\">Always a written authorisation<\/a> \u00b7 <a href=\"#commander\">What to order?<\/a> \u00b7 <a href=\"#sources\">Sources<\/a><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d86f394 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d86f394\" data-element_type=\"section\" data-e-type=\"section\" id=\"trois\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a2d3929\" data-id=\"a2d3929\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6382abe elementor-widget elementor-widget-heading\" data-id=\"6382abe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Three services that get confused<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a7115da elementor-widget elementor-widget-text-editor\" data-id=\"a7115da\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><table><thead><tr><th>Service<\/th><th>What it does<\/th><th>What you receive<\/th><\/tr><\/thead><tbody><tr><td><strong>Vulnerability scan<\/strong><\/td><td>A tool automatically queries your machines and compares what it sees with a database of known flaws.<\/td><td>A list of likely flaws, often long, that needs sorting.<\/td><\/tr><tr><td><strong>Security audit<\/strong><\/td><td>Auditors examine your architecture, configurations, code or organisation.<\/td><td>A report that ranks the flaws and tells you what to fix first.<\/td><\/tr><tr><td><strong>Penetration test<\/strong><\/td><td>Auditors put themselves in an attacker&#8217;s shoes and check whether a flaw can really be exploited, and with what impact<sup><a href=\"#source-1\">[1]<\/a><\/sup>.<\/td><td>Proof of what an attacker could do, step by step.<\/td><\/tr><\/tbody><\/table><div class=\"box\">For ANSSI, \u00ab fully automated vulnerability searching does not constitute an audit activity \u00bb<sup><a href=\"#source-1\">[1]<\/a><\/sup>. A scan is useful, but it is not an audit.<\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-592bdc5 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"592bdc5\" data-element_type=\"section\" data-e-type=\"section\" id=\"types\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2442f4e\" data-id=\"2442f4e\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3ea377 elementor-widget elementor-widget-heading\" data-id=\"a3ea377\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The five types of audit according to ANSSI<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-61941eb elementor-widget elementor-widget-text-editor\" data-id=\"61941eb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><p>The framework for qualified audit providers (PASSI) distinguishes five activities<sup><a href=\"#source-1\">[1]<\/a><\/sup>:<\/p><ol><li><strong>Architecture audit<\/strong>: the choice and positioning of equipment, and connections to the internet and to third-party networks.<\/li><li><strong>Configuration audit<\/strong>: the settings of network equipment, systems, applications and security products.<\/li><li><strong>Source code audit<\/strong>: flaws in an application&#8217;s code.<\/li><li><strong>Penetration test<\/strong>: exploiting flaws under real attack conditions.<\/li><li><strong>Organisational and physical audit<\/strong>: governance, procedures, security of premises.<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8776107 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8776107\" data-element_type=\"section\" data-e-type=\"section\" id=\"rapport\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1532094\" data-id=\"1532094\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-dc3979b elementor-widget elementor-widget-heading\" data-id=\"dc3979b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What the report should contain<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e5cb20f elementor-widget elementor-widget-text-editor\" data-id=\"e5cb20f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><p>The PASSI framework sets out the content of an audit report<sup><a href=\"#source-1\">[1]<\/a><\/sup>. It is a good checklist for judging any report:<\/p><ul><li>a <strong>summary that non-experts can understand<\/strong>: context, scope, critical flaws and an assessment of the security level;<\/li><li>a <strong>table of vulnerabilities<\/strong> ranked by impact and ease of exploitation;<\/li><li><strong>recommendations<\/strong> linked to each flaw, ranked by criticality and cost;<\/li><li>for a penetration test, the <strong>course of the test<\/strong> and the method used;<\/li><li>the <strong>limitations<\/strong>: what could not be covered, and the phases carried out by automated tools.<\/li><\/ul><p>A report that is nothing more than tool output, with no summary or priorities, will not help you decide.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1a50f37 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1a50f37\" data-element_type=\"section\" data-e-type=\"section\" id=\"loi\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9f4c41b\" data-id=\"9f4c41b\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-016da0c elementor-widget elementor-widget-heading\" data-id=\"016da0c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What the law requires, and what it does not<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f19049 elementor-widget elementor-widget-text-editor\" data-id=\"0f19049\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><ul><li><strong>The GDPR<\/strong> requires, for personal data processing, \u00ab a process for regularly testing, assessing and evaluating the effectiveness of the measures \u00bb for security (Article 32), at a level appropriate to the risk<sup><a href=\"#source-2\">[2]<\/a><\/sup>. It does not specifically require an audit or a penetration test: it is up to you to choose a proportionate process.<\/li><li><strong>The ISO\/IEC 27001 standard<\/strong> is a voluntary standard: a company decides for itself to become certified<sup><a href=\"#source-3\">[3]<\/a><\/sup>. It is not a legal obligation, even though a client may require it by contract.<\/li><li><strong>A PASSI qualification<\/strong> is only mandatory when a regulation or contract requires it. It can be checked on the ANSSI website.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-30e6bac elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"30e6bac\" data-element_type=\"section\" data-e-type=\"section\" id=\"autorisation\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-20d378b\" data-id=\"20d378b\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-90d5350 elementor-widget elementor-widget-heading\" data-id=\"90d5350\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Always a written authorisation<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f1d8264 elementor-widget elementor-widget-text-editor\" data-id=\"f1d8264\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><p>A penetration test means attacking systems: it is only done with the written consent of their owner. The PASSI framework provides for an agreement signed before the audit and, for a penetration test, an authorisation form signed by the client, the audited party and any third parties concerned (your hosting provider, for example), listing the targets, dates and times<sup><a href=\"#source-1\">[1]<\/a><\/sup>.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02a7bbc elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02a7bbc\" data-element_type=\"section\" data-e-type=\"section\" id=\"commander\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6669e3a\" data-id=\"6669e3a\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-bdfc223 elementor-widget elementor-widget-heading\" data-id=\"bdfc223\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What to order?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a2402c3 elementor-widget elementor-widget-text-editor\" data-id=\"a2402c3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><table><thead><tr><th>Your situation<\/th><th>What fits<\/th><\/tr><\/thead><tbody><tr><td>You do not know where you stand<\/td><td>An architecture and configuration audit, with a summary for management.<\/td><\/tr><tr><td>You want to track progress over time<\/td><td>A regular scan, alongside an audit, never instead of one.<\/td><\/tr><tr><td>A website or application exposed on the internet<\/td><td>A penetration test on that scope.<\/td><\/tr><tr><td>A client or a tender requires proof<\/td><td>Read the requirement: PASSI qualification, ISO 27001 certification and a simple audit report are not the same thing.<\/td><\/tr><\/tbody><\/table><p>Our audits are described on the <a href=\"https:\/\/mu.it-cyberwall.com\/en\/audit-de-securite\/\">Security audit<\/a> page.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7254e9e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7254e9e\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;,&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b69b529\" data-id=\"b69b529\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-30dee9b elementor-widget elementor-widget-heading\" data-id=\"30dee9b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Not sure what to order?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d6dd8e4 elementor-widget elementor-widget-text-editor\" data-id=\"d6dd8e4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Describe your context and what you are being asked for: we will tell you which type of audit fits.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e001a47 elementor-align-center elementor-widget elementor-widget-button\" data-id=\"e001a47\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-md\" href=\"https:\/\/mu.it-cyberwall.com\/en\/contact\/?mf-besoin=audit#formulaire\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-icon\">\n\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-arrow-right\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M190.5 66.9l22.2-22.2c9.4-9.4 24.6-9.4 33.9 0L441 239c9.4 9.4 9.4 24.6 0 33.9L246.6 467.3c-9.4 9.4-24.6 9.4-33.9 0l-22.2-22.2c-9.5-9.5-9.3-25 .4-34.3L311.4 296H24c-13.3 0-24-10.7-24-24v-32c0-13.3 10.7-24 24-24h287.4L190.9 101.2c-9.8-9.3-10-24.8-.4-34.3z\"><\/path><\/svg>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Describe my needs<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7f142f1 elementor-widget elementor-widget-text-editor\" data-id=\"7f142f1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><a href=\"https:\/\/mu.it-cyberwall.com\/en\/guides\/\">\u2190 All our guides<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-2fcb194 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"2fcb194\" data-element_type=\"section\" data-e-type=\"section\" id=\"sources\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-90414eb\" data-id=\"90414eb\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-1f422c7 elementor-widget elementor-widget-heading\" data-id=\"1f422c7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Sources<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ec2591 elementor-widget elementor-widget-text-editor\" data-id=\"4ec2591\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"itcw-g\"><p class=\"note\">Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.<\/p><ol class=\"src\"><li id=\"source-1\">ANSSI \u2013 Prestataires d\u2019audit de la s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information (PASSI), r\u00e9f\u00e9rentiel d\u2019exigences v2.1-a (1 September 2023) \u2014 <a href=\"https:\/\/cyber.gouv.fr\/sites\/default\/files\/document\/R%C3%A9f%C3%A9rentiel%20PASSI%20%E2%80%93%20version%202.1-a%20%E2%80%93%20sans%20marque%20de%20r%C3%A9vision.pdf\" target=\"_blank\" rel=\"noopener\">cyber.gouv.fr\/sites\/default\/files\/document\/R%C3%A9f%C3%A9rentiel%20PASSI%20%E2%80%93%20version%202.1-a%20%E2%80%93%20sans%20marque%20de%20r%C3%A9vision.pdf<\/a><\/li><li id=\"source-2\">CNIL \u2013 R\u00e8glement europ\u00e9en sur la protection des donn\u00e9es, chapitre 4 (article 32) \u2014 <a href=\"https:\/\/www.cnil.fr\/fr\/reglement-europeen-protection-donnees\/chapitre4\" target=\"_blank\" rel=\"noopener\">www.cnil.fr\/fr\/reglement-europeen-protection-donnees\/chapitre4<\/a><\/li><li id=\"source-3\">ISO \u2013 ISO\/IEC 27001, Information security management systems \u2014 <a href=\"https:\/\/www.iso.org\/isoiec-27001-information-security.html\" target=\"_blank\" rel=\"noopener\">www.iso.org\/isoiec-27001-information-security.html<\/a><\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":7206,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_titles_title":"Audit, scan or pentest: which to order? | IT CyberWall","_seopress_titles_desc":"Vulnerability scan, security audit or penetration test: ANSSI definitions, what the report contains, and what the GDPR and ISO 27001 require.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"sme penetration testing,it security audit,vulnerability scan,business pentest","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-7300","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/pages\/7300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/comments?post=7300"}],"version-history":[{"count":1,"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/pages\/7300\/revisions"}],"predecessor-version":[{"id":7301,"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/pages\/7300\/revisions\/7301"}],"up":[{"embeddable":true,"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/pages\/7206"}],"wp:attachment":[{"href":"https:\/\/mu.it-cyberwall.com\/en\/wp-json\/wp\/v2\/media?parent=7300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}