Exercise 2: Why a Named-Standard Contract Requirement Can't Be Satisfied by a Different Framework — Possible Solution
====================================================================

THE SCENARIO
------------------------------
A security firm is hired to test a government contractor's systems,
and the contract explicitly requires NIST-standard compliance.

WHY PTES DOESN'T SATISFY THIS, EVEN IF FOLLOWED THOROUGHLY
------------------------------
Per this chapter's own comparison table, PTES is maintained by
"community/industry practitioners," not a government body, and its
structure (7 phases) is a different, independently developed
framework from NIST SP 800-115's own 4-phase structure. The contract
doesn't ask for "a thorough, well-executed penetration test in
general" — it asks specifically for NIST-standard compliance. Per the
chapter's own warn-box, "specific contracts, industry regulations, or
compliance frameworks... can explicitly require testing to follow a
named standard." A named-standard requirement is a requirement to
follow THAT SPECIFIC document's own defined structure, phases, and
documentation requirements — not simply to conduct a test that is
"good" by some other standard's own definition of good.

WHY THE OWASP TESTING GUIDE ALSO DOESN'T SATISFY THIS
------------------------------
Per the chapter's own table, the OWASP Testing Guide's scope/focus is
"narrow — web applications specifically," maintained by OWASP, not
NIST. Even setting aside the maintainer mismatch, if the government
contractor's systems being tested aren't purely web applications (per
pentest1-2's own scope categories, they could include Network,
Wireless, or other categories the OWASP Testing Guide doesn't cover),
the Guide wouldn't even be structurally applicable to the full scope
of the engagement, on top of not being the specifically-named
standard the contract requires.

THE CORE PRINCIPLE
------------------------------
A named-standard compliance requirement isn't really about testing
quality — it's about being able to demonstrate, afterward, that this
SPECIFIC document's own defined process was followed. Following a
different framework well doesn't produce that specific evidence, no
matter how thorough the actual testing was.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains why both alternative frameworks fail to satisfy the
requirement for two different reasons drawn directly from the
chapter's own table (wrong maintainer/standard for PTES; wrong
scope entirely for the OWASP Testing Guide), rather than treating
"a good pentest is a good pentest" as sufficient.