Test accounts from the pentest were not removed afterwards
Description
The penetration test used several test accounts on internal systems and on the customer VPN gateway. After the test, two of these accounts were still active on the identity provider, with membership of a group with elevated rights. The tester found them again during the retest of the network. Test accounts should be removed on the day the test ends, and nobody had that removal as a Task.
Summary
On trackThis workflow is complete.
The test accounts were created for the tester at the start, and no step in the test plan removed them at the end.
The test plan now ends with a step to remove all test accounts on the final day, confirmed by the Service Desk Lead. The two remaining accounts were removed.
A check of the identity provider after the retest found no accounts left over from the test. The corrective action is effective.