NIST SP 800-115 is the Technical Guide to Information Security Testing and Assessment. It describes how to plan and conduct security testing such as vulnerability scanning, password audits, web application testing, and penetration testing. The goal is to turn security checks into a repeatable, documented process rather than an ad hoc exercise.
It matters because good defenses depend on evidence, not assumptions. In practice, teams use guidance like SP 800-115 to define scope, authorization, test methods, reporting, and safeguards before any scanner or tester touches production systems. That helps reduce risk from intrusive testing while improving coverage of applications, hosts, and network infrastructure. In attacks, the same techniques are used offensively to find weak controls, so defenders need strong permissions, logging, and rollback plans. SP 800-115 is often referenced alongside frameworks such as OWASP ASVS when organizations want continuous verification that controls still work as environments change.