Network Penetration Test Report

Document Control

Table of Contents

1. Executive Summary Overall risk, statistics, business impact
2. Scope and Methodology Assets, standards, tools, risk ratings
3. Findings Summary Severity distribution and all findings
4. Detailed Findings All 6 findings by priority band
5. Test Cases Control, target, DPP section, result
6. Compliance Evidence Package Amazon DPP, SOC 2, ISO 27001:2022
7. Programme Appendix Finding to DPP control mapping
8. Appendix Team, distribution, glossary
9. Disclaimer Limitations and sample notice

Executive Summary

Cybersecify performed an external network and email security assessment of Acme SaaS's staging perimeter in support of the Amazon SP-API Data Protection Policy submission. The assessment covered the externally reachable hosts, the TLS posture at the edge, and the email authentication and transport security configuration for the domain that carries Amazon related notifications.

The external service posture is tight. The reachable surface is limited to HTTPS on the expected hosts, TLS is current, and no unnecessary services were exposed. The findings concentrate in email security. The sending domain lacks a complete SPF policy and DKIM signing, and does not publish MTA-STS or TLS-RPT. Together these weaken the guarantees that a message claiming to come from Acme is genuine and that mail to Acme is delivered over enforced TLS. For a platform that sends and receives order and account notifications tied to Amazon buyers, these are the priority items for the submission.

Key Statistics

Business Impact Summary

The email authentication gaps are the material risk. Without an enforced SPF policy and DKIM signatures, a third party can send mail that appears to originate from the Acme domain, which supports phishing of buyers, sellers and staff using Acme's own brand. The absence of MTA-STS and TLS-RPT means inbound mail can be delivered over an unauthenticated or downgraded channel without any reporting signal. Each of these should be remediated and retested before the Letter of Attestation is issued.

Scope and Methodology

This was an external, unauthenticated network and email security assessment against the staging perimeter and the associated sending domain. No internal network access was in scope and no exploitation of third party mail infrastructure was performed.

In Scope Assets

Out of Scope

Internal network testing; denial of service and volumetric testing; exploitation or relay testing against third party mail providers; social engineering; physical security. Testing was non intrusive and limited to externally observable configuration. The AWS account and cluster configuration is assessed separately in the cloud report for the same engagement.

Methodology and Standards

Tools

Testing Approach

External, unauthenticated inspection of the reachable service surface, the TLS configuration and the published DNS and email security records for the assessed domain. All checks were passive or single request and non intrusive. No mail was spoofed against live recipients and no third party infrastructure was tested.

Risk Rating Definitions

Severity is assigned from the CVSS v3.1 base score. Ratings describe the risk the condition presents in this environment, not a generic product rating.

Deliverables and Retest

This v1.0 report is the report of record for its scope. A full retest of every finding is carried out within 30 calendar days of delivery. The v2.0 retest report, showing each finding as closed, partially closed, or accepted as a documented risk, is issued within 3 business days of the retest completing. A Letter of Attestation, signed by the OSCP certified lead tester, follows the retest and confirms that an independent manual penetration test was performed to Amazon's requirements. The Letter is supporting evidence for the SP-API Data Protection Policy submission and is not a certification.

Policy Basis for the Mapping

Every DPP citation in this report refers to a numbered requirement in the Amazon Data Protection Policy as published: Section 1, General Security Requirements (1.1 Network Protection through 1.7 Request for Deletion or Return), and Section 2, Additional Security Requirements Specific to Personally Identifiable Information (2.1 Data Retention through 2.7 Vulnerability Management). No control domain is inferred or renumbered. Where a condition has no corresponding requirement in the published policy, the mapping says so rather than assigning one.

Amazon Required Report Elements

This report is structured to cover the six elements Amazon expects of a penetration test report submitted in support of SP-API DPP approval. Amazon reviews and decides on the submission; this report is independent, third party evidence and not an approval.

Findings Summary

The assessment produced 6 findings: 3 Medium and 3 Informational. No Critical or High severity findings were identified. The three email security findings are grouped as P1 for the submission; the informational edge and DNS observations are P3.

Findings Identified by Severity

Severity Distribution

All Findings

This is a redacted sample. The table above lists the full finding set by title; Section 4 gives complete write ups for a representative finding in each priority band present in this report (P1 and P3) and across the severity range, so the reader can see the exact format, evidence, and Amazon DPP mapping without reproducing every finding. A real engagement report details every finding in full.

Priority Definitions

Findings are grouped by remediation priority for the Amazon SP-API Data Protection Policy submission. P1 findings block the submission and must be remediated and retested before the Letter of Attestation is issued. P2 findings are DPP relevant but not submission blocking; they strengthen the attestation and should be remediated on the stated timeline. P3 findings are lower priority hardening items that improve the overall security posture and are addressed in the normal hardening cycle.

Detailed Findings

All 6 findings are listed below in the same structure. The source report publishes complete write ups for one finding in each priority band present, CS-2026-S01 for P1 and CS-2026-S05 for P3, and publishes the summary attributes for the remaining four. Those four are reproduced here exactly as the source states them, with no description, vector string or CWE added.

P1 · DPP Submission Blockers

dig +short TXT acmesaas.io
"v=spf1 include:_spf.<partial> ~all"    (primary and transactional providers absent; ~all soft fail)

P3 · Lower Priority Hardening Findings

curl -sS https://acmesaas.io/.well-known/security.txt

HTTP 404 (no disclosure contact)

Test Cases

Each test case maps to the assessed control and the finding that resulted. Every case below returned a FAIL and corresponds to a confirmed finding; controls confirmed working are recorded in the Compliance Evidence Package.

Compliance Evidence Package

This section maps findings and positive controls to the published Amazon Data Protection Policy, the SOC 2 Trust Services Criteria, and ISO 27001:2022 Annex A. Every DPP citation refers to a numbered requirement in the policy as published by Amazon. The coverage below is limited to the requirements an external network and email assessment can speak to; the remaining requirements are addressed in the cloud report for the same engagement. This assessment is independent evaluation evidence. Cybersecify is not a CPA firm and does not perform the SOC 2 examination, is not ISO 27001 or SOC 2 certified, and does not approve the DPP submission.

A. Positive Controls Confirmed

B. Amazon DPP Section Coverage

C. SOC 2 Trust Services Criteria Coverage

D. ISO 27001:2022 Annex A Coverage

Programme Appendix

Finding to DPP control mapping and priority band coverage for the SP-API Data Protection Policy submission programme.

Appendix

A. Testing Team and Authorisation

Certification verifiable via the assessor's Credly badge issued by OffSec.

B. Report Distribution

C. Glossary

Disclaimer

Limitations of Testing

Penetration testing is inherently limited by the scope, time, and resources allocated to the engagement. No individual or organisation can guarantee identifying all security issues. The testing performed is conducted on a best effort basis, and the findings reported herein are specific to the environment provided for testing.

Scope of Findings

The reported findings apply exclusively to the tested environment and configurations during testing. Information systems rely on human factors and can be inherently vulnerable to human error. While Cybersecify has endeavoured to identify significant security vulnerabilities in the analysed systems, it is impossible to assure that all potential vulnerabilities have been discovered. This document does not constitute legal advice.

Continued Vigilance

Security is an ongoing process. Regular assessments and updates to security measures are essential to maintaining a strong security posture. Cybersecify recommends periodic penetration testing and continuous monitoring to adapt to new threats and vulnerabilities.

Sample Notice

This is a redacted sample report for a fictional company, Acme SaaS Pvt. Ltd., produced to demonstrate the structure, finding format, and compliance mapping of a Cybersecify Amazon SP-API Data Protection Policy engagement. The company, domains, addresses, identifiers, and findings are illustrative and do not describe any real client or assessment.

Cyber Secify Consulting (OPC) Private Limited  ·  contact@cybersecify.com  ·  Bengaluru, India