FedRAMP High CA-8: Penetration Testing

What else in your programme already covers this

This control maps to 101 controls across 66 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

11.4.1 Penetration testing methodology defined
11.4.2 Internal penetration testing annually
11.4.3 External penetration testing annually
11.4.5 Segmentation testing
11.4.6 Segmentation testing (service providers) every 6 months
6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application

CIS Controls v8 · 5 controls

CIS-16.13 Conduct Application Penetration Testing
CIS-18.1 Establish and Maintain a Penetration Testing Program
CIS-18.2 Perform Periodic External Penetration Tests
CIS-18.3 Remediate Penetration Test Findings
CIS-18.5 Perform Periodic Internal Penetration Tests

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-29 Host-based IDS/IPS (Very Good)
ASD37-32 Network-based IDS/IPS (Limited)

Azure Security Benchmark · 2 controls

ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
ASBv3-PV-7 Conduct regular red team operations

C5 (Germany) · 2 controls

C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
C5-OPS-22 Testing and Documentation of known Vulnerabilities

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-14 External Penetration Testing
CFTC-SS-34 Internal Penetration Testing

DORA · 2 controls

DORA-Art.25 Testing of ICT tools and systems
DORA-Art.26 Advanced testing of ICT tools, systems and processes based on TLPT

ISO 27001:2022 · 2 controls

5.35 Independent review of information security
8.29 Security testing in development and acceptance

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.IM-01 Improvements are identified from evaluations
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring

NIST SP 800-218 · 2 controls

SP800-218-PW.8.1 Executable Testing for Security
SP800-218-PW.8.2 Execute Security Testing

NIST SP 800-53 Rev 5 · 2 controls

NIST800-CA-7 Continuous monitoring
NIST800-CA-8 Penetration testing

SOC 2 · 2 controls

SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
SOC2-CC7.1 Detection and monitoring procedures for security events are in place

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-33 Testing the effectiveness of safeguards

API 1164 · 1 control

API1164-13 Business Continuity and Recovery

AWS Well-Architected Security Pillar · 1 control

SEC11-BP03 Perform regular penetration testing

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 1 control

AT-DSG-6 Sections 12-13 - Image processing (video surveillance/CCTV)

BSI IT-Grundschutz · 1 control

BSI-17 Continuous monitoring strategy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-TVM-06 Penetration Testing

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

CAT-D3-2 Detective controls

FISMA · 1 control

FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g))

FedRAMP Moderate · 1 control

IR-4 Incident Handling

FedRAMP Rev 5 · 1 control

FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests

Florida Digital Bill of Rights (FDBR) · 1 control

FDBR-Enforcement-AG-CurePeriod Enforcement by Florida Department of Legal Affairs + Penalties + 45-Day Cure (Fla. Stat. 501.72, 501.721, 501.722)

Ghana Cybersecurity Act · 1 control

GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IAEA-NSS17-Detect-Monitor-Logging-IR-Recovery-Exercises IAEA NSS-17 - Detection + Monitoring + Logging + Incident Response + Recovery + Computer Security Exercises

IAIS Insurance Core Principles (ICPs) · 1 control

ICP-24 Macroprudential Surveillance and Insurance Supervision

IEC 62443 · 1 control

IEC62443-13 Network security monitoring

IEEE 1686 · 1 control

IEEE1686-Section5.2-5.3-AuditLog-Retention-Export-Monitoring IEEE 1686 Section 5.2 + 5.3 - Audit Trail Records + Retention + Export + Supervisory Monitoring and Control + Network Security Monitoring

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

IMO-MSC-FAL-Detect-AnomalyDetection-OT-IT-Monitoring-Reporting-BridgeAlarms IMO MSC-FAL Detect Function - Anomaly Detection + OT and IT System Monitoring + Bridge Alarms + Log Aggregation + Incident Reporting Channels + Crew Observation

ISMAP (Japan) · 1 control

ISMAP-CloudOperations-Monitoring-Logging-IncidentResponse-NISC-Reporting-Vulnerability-Change-SLA ISMAP Cloud Operations - Security Monitoring + SIEM + Logging + Incident Response + NISC Reporting + Vulnerability Management + Penetration Testing + Change Management + SLA Management

ISO 27002:2022 · 1 control

8.29 Security testing in development and acceptance

ISO 27017 · 1 control

ISO27017-21 Cloud security monitoring and logging

ISO 27018 · 1 control

ISO27018-21 Cloud security monitoring and logging

ISO 27019 · 1 control

ISO27019-13 Network security monitoring

ISO 27701:2019 · 1 control

6.15.2 Information security reviews

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO28001-PS-01 Facility Security

ISO/IEC 27006:2024 · 1 control

27006-9.4 Surveillance and recertification

ISO/IEC 27400:2022 · 1 control

27400-6.5 Security monitoring and incident response

Japan FSA Cybersecurity Guidelines for Financial Institutions · 1 control

JP-FSA-CYB-Security-Monitoring-SOC-Operations-SIEM-EDR-MDR-XDR-24x7-Detection-Alert-Triage Japan FSA Cybersecurity Security Monitoring + SOC 24x7 Operations + SIEM + EDR + MDR + XDR + Detection + Alert Triage + Threat Hunting + Incident Response Integration + Threat Intelligence Integration + UEBA

MTCS (Singapore) · 1 control

MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM

NERC CIP · 1 control

NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NIST SP 1800-32 · 1 control

NIST1800-32-13 Network security monitoring

NIST SP 800-144 · 1 control

NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance

NIST SP 800-145 · 1 control

NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NISTSP146-6 Cloud Security and Privacy Recommendations

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 1 control

3.12 Segment Data Processing and Storage Based on Sensitivity

NIST SP 800-172 · 1 control

3.12.1e Penetration Testing by Independent Agents

NIST SP 800-190 · 1 control

NIST190-21 Cloud security monitoring and logging

NIST SP 800-53 Rev 5 LOW · 1 control

IR-4 Incident Handling

NIST SP 800-53 Rev 5 MODERATE · 1 control

IR-4 Incident Handling

NIST SP 800-53 Revision 5.1 HIGH · 1 control

IR-4 Incident Handling

NIST SP 800-53A Rev. 5 · 1 control

53A-D Penetration Testing

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

RG5.71-C.7 Continuous Monitoring

New Zealand Information Security Manual (NZISM) · 1 control

NZISM-5 Network Security, System Hardening, and Application Security

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

DSOMM-5 Information Gathering, Logging, Monitoring, and Incident Response

Oman National Cybersecurity Framework · 1 control

OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-SEC.3 Network Security

South Korea ISMS-P · 1 control

ISMSP-SYS-03 Security Monitoring and Log Management

TSA Pipeline Cybersecurity Directives · 1 control

TSAPIPE-2 OT/IT Network Segmentation and Access Control

UK Telecommunications (Security) Act 2021 · 1 control

UK-TSA-MON-01 Security Monitoring

US SEC Digital Assets and Crypto Regulatory Framework · 1 control

US-SEC-DA-SC-03 ETF Framework

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.