NIST SP 800-115

The U.S. government's technical guide to information security testing and assessment.

What It Is

NIST Special Publication 800-115, "Technical Guide to Information Security Testing and Assessment," is published by the U.S. National Institute of Standards and Technology. It provides a structured methodology for planning and executing security testing, moving from target discovery through active testing to a final report that ties findings back to real business risk.

Why It's Still Relevant

NIST SP 800-115 underpins security testing requirements for U.S. federal information systems, referenced by FISMA-driven security programs, and it's widely adopted well beyond government in regulated industries that need a rigorous, auditable methodology. Despite its original 2008 publication date, it has not been superseded and remains an active NIST reference document — a rare case of a security standard that has stayed current by being written at the right level of abstraction rather than tied to specific tools or attack techniques.

Phases, as Implemented in SecurAppt

Planning

Discovery

Scanning

Vulnerability Assessment

Exploitation

Reporting

Run a NIST-Guided Pentest Session

SecurAppt automatically surfaces the right tools for each NIST SP 800-115 phase.

Start a Pentest Session