OSSTMM focuses on which of the following in security testing?

• A. To benchmark social engineering effectiveness
• B. To audit compliance with industry standards
• C. To improve transparency, repeatability, and quality across many kinds of security testing
• D. To document legal obligations for data handling

Answer: (C)

OSSTMM aims to provide a rigorous, repeatable framework for security testing that makes results transparent and comparable. It emphasizes objective, standardized metrics and procedures so tests can be performed consistently across different kinds of assessments, whether they’re network, application, or physical security. That focus on measurement, repeatability, and quality across diverse test types is what sets OSSTMM apart.

This isn’t about benchmarking social engineering, auditing compliance with industry standards, or detailing legal data-handling obligations. Those concerns are outside its primary scope, which is the methodology and measurement framework for security testing.