Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)
I'm assuming by methodology you are looking for a social engineering framework. At a really high level, you'd follow the same sort of steps that you would with any other attack.
- Pick a target
- Study the target
- Identify vulnerabilities
- Create plan to exploit identified vulnerabilities
- Execute the plan
- Walk out unscathed
Much like a technical hack, there may be many hops from entry to final destination within a company. A remote attacker might need to know Linux, macOS, Windows, and a few scripting languages to make it through the barriers. A social engineer needs the ability to build trust and think on their feet as they iterate through their targets, especially in live environments (say pentesting a bank).
For some good, free, social engineering information I highly recommend digging through social-engineer.org. They not only run their own seminars but frequently work with DefCon to create the social engineering village. A good place to start is here: