3.2 Testing Frameworks and Methodologies
Key Takeaways
- PTES is a seven-phase penetration testing process standard from pre-engagement through reporting; it is the closest blueprint-style 'how a pentest runs' document on the list.
- OSSTMM is a broader ISECOM operational-security testing methodology with scientific measurement (including RAV), not merely a pentest playbook.
- MITRE ATT&CK is an adversary technique knowledge base used to map coverage; it is not a pentest contract, RoE, or statement of work.
- OWASP Top 10 is a web risk-awareness document; OWASP MASVS is a mobile application security verification standard with numbered control groups.
- CREST is a professional assurance and accreditation ecosystem; the Purdue model is an ICS/OT segmentation architecture (levels 0–5) used when scoping industrial tests.
PT0-003 objective 1.3 is a compare-and-contrast item family. CompTIA lists seven named frameworks or methodologies plus three threat-modeling models (covered in the next section). The exam trick is mixing up what each artifact is for. A knowledge base is not a contract. An awareness list is not a full methodology. An ICS architecture diagram is not a web test plan. Learn the job of each name, then the trap answers write themselves.
Penetration Testing Execution Standard (PTES)
PTES is a penetration testing process standard. It describes how a pentest runs from first conversation through the report.
The seven phases
The seven sections are:
- Pre-engagement Interactions
- Intelligence Gathering
- Threat Modeling
- Vulnerability Analysis
- Exploitation
- Post Exploitation
- Reporting
When an exam stem asks which document covers scoping conversations, exploitation, post-exploitation, and reporting as one pentest lifecycle, PTES is the match. PTES is not a CVSS calculator, not an ICS zoning model, and not a list of the ten most common web risks. Teams use it to structure an SoW-friendly methodology: what happens before authorization is confirmed, what "threat modeling" means in the test, and what the customer should expect in the report.
Open Source Security Testing Methodology Manual (OSSTMM)
OSSTMM, maintained by ISECOM (Institute for Security and Open Methodologies), is a broader security testing methodology with a scientific-measurement emphasis. OSSTMM 3 is the widely cited edition. It characterizes operational security across channels, not only "can I get a shell." The channels testers should recognize are Human, Physical, Wireless, Telecommunications, and Data Networks.
OSSTMM's distinctive exam fingerprint is measurement. Tests are meant to produce repeatable characterization of operational security rather than a pile of anecdotal screenshots. ISECOM's RAV (Risk Assessment Values) calculator is the associated quantitative companion. If the stem says "scientific method," "operational security," or "channels including human and physical," think OSSTMM — not PTES. OSSTMM can include penetration testing, but it is not only a pentest playbook and it is not a web Top 10 list.
Council of Registered Ethical Security Testers (CREST)
CREST is a professional assurance and accreditation body and the methodology ecosystem around it, not a single seven-phase PDF that replaces PTES. Originating in the United Kingdom and now used internationally, CREST accredits companies, certifies individual testers (for example the CREST Registered Tester path), publishes buying guidance, and expects members to follow a professional code of conduct. Buyers use CREST membership as a quality signal when procuring a pentest. Testers use CREST syllabi and related methodologies when a customer requires CREST-assured work.
Exam trap: CREST is not "the OWASP list for the United Kingdom" and not a MITRE matrix. If the stem is about who assures the provider or which body accredits ethical security testers, CREST is the answer. If the stem is about seven pentest phases, that is PTES.
MITRE ATT&CK
MITRE ATT&CK is an adversary tactics, techniques, and procedures (TTP) knowledge base. Matrices exist for Enterprise, Mobile, and ICS. Columns are tactics (the adversary's goals, such as Credential Access or Lateral Movement); cells are techniques and sub-techniques (how those goals are attempted).
ATT&CK is how you map coverage: "we emulated T1059.001 PowerShell and T1003.003 NTDS, but we never touched T1557 adversary-in-the-middle." Purple teams, detection engineers, and pentesters all use it that way. It is not a pentest contract, not a rules-of-engagement template, and not a replacement for pre-engagement legal authorization. Putting "MITRE ATT&CK" in a proposal does not authorize you to attack production. On the exam, "map techniques," "coverage," or "adversary emulation" points to ATT&CK; "statement of work" or "seven phases" does not.
OWASP Top 10 versus OWASP MASVS
The OWASP Top 10 (Open Worldwide Application Security Project) is a web application risk-awareness document. It is periodically updated; the current published edition as of 2026 is OWASP Top 10:2025, whose categories include Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions. PT0-003 launched against the 2023 objectives, so treat the Top 10 as a named awareness list that changes, not as a frozen ten-item methodology you must recite as a contract. The exam point is the role: testers map web findings to Top 10 categories to communicate risk to developers. It does not define pre-engagement, post-exploitation, or reporting the way PTES does, and it is not a mobile standard.
OWASP MASVS (Mobile Application Security Verification Standard) is a verification standard for mobile apps. Current MASVS control groups include STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, and PRIVACY. From v2.0 the old L1/L2/R verification levels were moved into MAS Testing Profiles / MASTG rather than living inside MASVS itself; older study notes still mention L1, L2, and R. For PenTest+, remember the job: MASVS tells you what to verify on iOS and Android applications. It is not the web Top 10, not ATT&CK Mobile (which describes adversary techniques), and not a full organizational risk method like OCTAVE.
Purdue Model (ICS/OT Scoping)
The Purdue model (Purdue Enterprise Reference Architecture, commonly applied to industrial control) is an ICS/OT network segmentation architecture, not a pentest methodology. Know the levels well enough to scope a plant without treating a PLC as "just another host."
| Level | Role | Examples | Pentest caution |
|---|---|---|---|
| 0 | Physical process | Sensors, actuators, motors | Affecting Level 0 is a safety and process-integrity event |
| 1 | Basic control | PLCs, RTUs | Changing logic or setpoints can move real equipment |
| 2 | Supervisory control | HMI, SCADA servers | A tripped HMI can halt operations even without a PLC rewrite |
| 3 | Site operations | MES, historians, operations workstations | Common IT-looking systems that still sit on the OT side |
| 4 | Site business planning | ERP, site IT, email | IT zone; still should not freely route to Level 1 |
| 5 | Enterprise | Corporate networks and services | Furthest from the process; still a pivot source if flattened |
Why Level 3 to Level 1 is unsafe
Many plants also place a DMZ (often called Level 3.5) between operations (Level 3) and business IT (Level 4). You do not need a 2,000-word ICS treatise for PT0-003. You do need this instinct: jumping from Level 3 operations to Level 1 basic control is a scoping and safety issue. It can skip supervisory protections and put a tester in a position to alter the physical process. If the RoE authorized a Level 3 historian review, that is not silent permission to flash PLC logic. Call it out, get explicit authorization, and use OT-safe methods (read-only, outages windows, vendor-approved tools) or refuse the hop.
| Artifact | What it is | What it is not | Exam cue |
|---|---|---|---|
| PTES | Pentest process standard (seven phases) | A scoring model or ICS zoning diagram | Pre-engagement through reporting |
| OSSTMM | Scientific operational-security methodology (ISECOM) | Only a web checklist | Channels, measurement, RAV |
| CREST | Assurance/accreditation body and related methodology ecosystem | A MITRE matrix | Accredited testers and firms |
| MITRE ATT&CK | Adversary TTP knowledge base | A pentest contract or RoE | Map techniques and coverage |
| OWASP Top 10 | Web risk-awareness list | A full pentest methodology | Map web findings; not seven phases |
| OWASP MASVS | Mobile app security verification standard | The web Top 10 | Mobile control groups |
| Purdue model | ICS/OT segmentation architecture (levels 0–5) | A pentest execution standard | Do not hop Level 3 to Level 1 unscoped |
Memorize the job of each name. PTES tells you how a pentest proceeds. OSSTMM tells you how to measure operational security scientifically. CREST tells you who is accredited to do the work. ATT&CK tells you which adversary techniques you covered. Top 10 tells developers which web risk classes showed up. MASVS tells you whether a mobile app meets a verification standard. Purdue tells you where you are standing in a plant — and why the next hop may be unsafe.
A client wants a written methodology that covers the full penetration-test lifecycle from pre-engagement conversations through exploitation, post-exploitation, and reporting. Which listed artifact is the process standard that matches that request?
A report appendix maps each successful attack to a tactic and technique ID so the SOC can see which adversary behaviors were covered and which were not. What is MITRE ATT&CK in this situation?
An engagement is scoped to a plant's Level 3 operations network (MES and historians). The tester discovers a route to a Level 1 PLC network that drives motors on the line. Why is pivoting from Level 3 to Level 1 a problem on PT0-003?