Frameworks / FedRAMP High / CA-8 FedRAMP High
CA - Assessment, Authorization, and Monitoring
FedRAMP High CA-8: Penetration Testing Conduct penetration testing annually on FedRAMP-defined systems and components.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 97 controls across 61 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
11.4.1 11.4.1 Penetration testing methodology defined and implemented 11.4.2 11.4.2 Internal penetration testing annually and after change 11.4.3 11.4.3 External penetration testing annually and after change 11.4.5 11.4.5 Annual segmentation penetration testing 11.4.6 11.4.6 Service provider segmentation testing every six months 6.4.1 6.4.1 Public web application review or automated protection CIS-16.13 Conduct Application Penetration Testing CIS-18.1 Establish and Maintain a Penetration Testing Program CIS-18.2 Perform Periodic External Penetration Tests CIS-18.3 Remediate Penetration Test Findings CIS-18.5 Perform Periodic Internal Penetration Tests ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline ASBv3-PV-7 Conduct regular red team operations C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests C5-OPS-22 Testing and Documentation of known Vulnerabilities DORA-Art.25 Testing of ICT tools and systems DORA-Art.26 Advanced testing of ICT tools, systems and processes based on TLPT 5.35 Independent review of information security 8.29 Security testing in development and acceptance SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions CBPR-PR-33 Testing the effectiveness of safeguards API1164-13 Business Continuity and Recovery AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program AT-DSG-6 Sections 12-13 - Image processing (video surveillance/CCTV) BSI-17 Continuous monitoring strategy CAT-D3-2 Detective controls FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g)) FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests FDBR-Enforcement-AG-CurePeriod Enforcement by Florida Department of Legal Affairs + Penalties + 45-Day Cure (Fla. Stat. 501.72, 501.721, 501.722) GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel ICP-24 Macroprudential Surveillance and Insurance Supervision IEC62443-13 Network security monitoring IEEE1686-Section5.2-5.3-AuditLog-Retention-Export-Monitoring IEEE 1686 Section 5.2 + 5.3 - Audit Trail Records + Retention + Export + Supervisory Monitoring and Control + Network Security Monitoring IMO-MSC-FAL-Detect-AnomalyDetection-OT-IT-Monitoring-Reporting-BridgeAlarms IMO MSC-FAL Detect Function - Anomaly Detection + OT and IT System Monitoring + Bridge Alarms + Log Aggregation + Incident Reporting Channels + Crew Observation 8.29 Security testing in development and acceptance 6.15.2 Information security reviews ISO28001-PS-01 Facility Security 27006-9.4 Surveillance and recertification ISO27019-13 Network security monitoring 27400-6.5 Security monitoring and incident response JP-FSA-CYB-Security-Monitoring-SOC-Operations-SIEM-EDR-MDR-XDR-24x7-Detection-Alert-Triage Japan FSA Cybersecurity Security Monitoring + SOC 24x7 Operations + SIEM + EDR + MDR + XDR + Detection + Alert Triage + Threat Hunting + Incident Response Integration + Threat Intelligence Integration + UEBA MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition 3.12.1e Penetration Testing by Independent Agents CA-8 CA-8 Penetration Testing 53A-D Penetration Testing NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NZISM-5 Network Security, System Hardening, and Application Security DSOMM-5 Information Gathering, Logging, Monitoring, and Incident Response OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification IM8-SEC.3 Network Security ISMSP-SYS-03 Security Monitoring and Log Management TSAPIPE-2 OT/IT Network Segmentation and Access Control UK-TSA-MON-01 Security Monitoring US-SEC-DA-SC-03 ETF Framework Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CA - Assessment, Authorization, and Monitoring You are reading one control. How much of FedRAMP High have you already done? FedRAMP High CA-8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP High your existing evidence covers. Hold C5 (Germany) and 119 of 410 FedRAMP High controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 6 were rejected on the C5 (Germany) pair alone.
Query this from an agent The graph holds this control, the 97 it maps to, and the evidence behind each claim, over MCP and REST.