Penetration Testing CA-8

Assessment, Authorization, and Monitoring · High baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CA-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Assessment, Authorization, and Monitoring family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CA-8 (Penetration Testing) goes beyond checking that controls are configured — it takes an attacker's mindset to see whether they actually hold. A penetration test tries to reach or break the system the way a real adversary would, within an agreed scope and rules of engagement, and reports what got through. It is a High-baseline control, so it is expected on higher-impact systems rather than every server.

What good looks like

Set scope and rules of engagement first — which targets, which techniques are allowed, and the time window — in writing, before any testing.
Test like an attacker — enumerate services, probe for weak configurations and known vulnerabilities, and attempt realistic exploitation within scope.
Keep the tester independent where you can — a fresh set of eyes finds what the builder overlooked.
Record what got through, how, and the impact — findings feed the plan of action (CA-5), not just a pass or fail.
Run it on a defined frequency, and re-test after significant changes.

Framework mapping

NIST CSF 2.0 — ID.RA-01 — Vulnerabilities in assets are identified, validated, and recorded
CIS Controls v8 — Control 18 — Establish and maintain a penetration testing program

How to move it toward Implemented

Agree the rules of engagement in writing — this host as the only target, the allowed window, and which techniques are in scope — before starting.
Run an external scan from a separate box (for example, a Kali Linux machine): nmap -sV -sC to map open services and versions, then targeted checks such as a web scanner (nikto) plus authenticated checks for weak configurations.
Write up each finding — what was reached, how, and its impact — and open a matching item in the plan of action (CA-5).
Attach the dated test report (scope, method, and findings) as hardening evidence on the asset, naming CA-8 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.