C5 (Germany)
C5: Operations

C5 (Germany) C5-OPS-19: Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests

Commission penetration tests at least annually by qualified internal personnel or external providers, following a documented test methodology across the components identified as relevant in a risk analysis, rating findings against defined criteria and remediating medium and high criticality findings within set time windows.

What else in your programme already covers this

This control maps to 58 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 6 controls

  • CIS-16.13 Conduct Application Penetration Testing
  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-18.2 Perform Periodic External Penetration Tests
  • CIS-18.3 Remediate Penetration Test Findings
  • CIS-18.5 Perform Periodic Internal Penetration Tests
  • CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets

PCI DSS 4.0 · 6 controls

  • 11.1.1 Testing policy documented
  • 11.4.1 Penetration testing methodology defined
  • 11.4.2 Internal penetration testing annually
  • 11.4.3 External penetration testing annually
  • 11.4.4 Pen test findings remediated
  • 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application

FedRAMP High · 4 controls

  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
  • CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
  • RA-5 Vulnerability Monitoring and Scanning

FedRAMP Moderate · 4 controls

  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
  • CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
  • RA-5 Vulnerability Monitoring and Scanning

APRA CPS 234 · 2 controls

  • CPS234-22 Systematic Control Testing Program
  • CPS234-P30 Independence and Skill of Testing Personnel
  • AUCDR-IS-4 Formal vulnerability management program
  • AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program
  • ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
  • ASBv3-PV-7 Conduct regular red team operations

DORA · 2 controls

ISO 27001:2022 · 2 controls

  • 8.29 Security testing in development and acceptance
  • 8.8 Management of technical vulnerabilities

ISO 27002:2022 · 2 controls

  • 8.29 Security testing in development and acceptance
  • 8.8 Management of technical vulnerabilities

NIST SP 800-218 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

  • CA-8 Penetration Testing
  • RA-5 Vulnerability Monitoring and Scanning

SOC 2 · 2 controls

  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
  • SOC2-CC7.1 Detection and monitoring procedures for security events are in place
  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions
  • CBPR-PR-33 Testing the effectiveness of safeguards

CMMC 2.0 · 1 control

HIPAA Security Rule · 1 control

NIS2 Directive · 1 control

  • Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures

NIST SP 800-172 · 1 control

  • 3.12.1e Penetration Testing by Independent Agents
  • RA-5 Vulnerability Monitoring and Scanning
  • RA-5 Vulnerability Monitoring and Scanning

UK Cyber Essentials · 1 control

  • CE-SU.3 Critical and High Updates within 14 Days

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Operations

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) C5-OPS-19 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

Query this from an agent

The graph holds this control, the 58 it maps to, and the evidence behind each claim, over MCP and REST.