Skip to content

M9-11 Independent Penetration Test Facilitation & Remediation

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3, Appendix 6 Requirement Clarity: ✅ Clear — engagement of the third party is Curo's responsibility, not NeuralRays'; NeuralRays facilitates access and remediates findings Dev Status: ⚪ Not yet scheduled

Overview

Facilitate a third-party penetration test (commissioned by Curo, not NeuralRays) before go-live, and remediate any Critical or High findings.

Tasks

  • Confirm with Curo the pen-test vendor and schedule (Appendix 5, DEP9 — "Completion of independent penetration testing (unless agreed not to)")
  • Provide the pen-test team with necessary access
  • Triage findings by severity
  • Fix all Critical/High findings before go-live (M10)

Dependencies

  • Needs a substantially complete, deployed system to test against — realistically scheduled after M6/M8 releases.
  • M10 — go-live is gated on this being clean.

Acceptance Criteria

  • Independent penetration test completed
  • All Critical/High findings remediated (per SOW Appendix 3, Security Testing; Appendix 6 — "Curo may require a penetration test... supplier required to fix any Critical or High defects before acceptance")

Existing Reference Material

  • SOW Appendix 5, DEP9; Appendix 6, Security Requirements

Blockers & Risks

  • Remediation of findings needs to complete before M10 acceptance — booking the pen-test vendor early (once the platform is substantially deployed, e.g. around M6/M7) rather than waiting until M9 formally starts gives more room to address findings properly.