FedRAMP Moderate
CA - Assessment, Authorization, and Monitoring

FedRAMP Moderate CA-8: Penetration Testing

Conduct penetration testing annually on FedRAMP-defined systems and components.

What else in your programme already covers this

This control maps to 101 controls across 66 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

  • 11.4.1 Penetration testing methodology defined
  • 11.4.2 Internal penetration testing annually
  • 11.4.3 External penetration testing annually
  • 11.4.5 Segmentation testing
  • 11.4.6 Segmentation testing (service providers) every 6 months
  • 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application

CIS Controls v8 · 5 controls

  • CIS-16.13 Conduct Application Penetration Testing
  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-18.2 Perform Periodic External Penetration Tests
  • CIS-18.3 Remediate Penetration Test Findings
  • CIS-18.5 Perform Periodic Internal Penetration Tests

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

Azure Security Benchmark · 2 controls

  • ASBv3-DS-5 Integrate dynamic application security testing into DevOps pipeline
  • ASBv3-PV-7 Conduct regular red team operations

C5 (Germany) · 2 controls

  • C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
  • C5-OPS-22 Testing and Documentation of known Vulnerabilities

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

DORA · 2 controls

  • DORA-Art.25 Testing of ICT tools and systems
  • DORA-Art.26 Advanced testing of ICT tools, systems and processes based on TLPT

ISO 27001:2022 · 2 controls

  • 5.35 Independent review of information security
  • 8.29 Security testing in development and acceptance

NIST Cybersecurity Framework 2.0 · 2 controls

NIST SP 800-218 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC4.1 COSO principle 16: Selects and develops ongoing and separate evaluations
  • SOC2-CC7.1 Detection and monitoring procedures for security events are in place

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

  • CBPR-PR-33 Testing the effectiveness of safeguards

API 1164 · 1 control

AWS Well-Architected Security Pillar · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 1 control

  • AT-DSG-6 Sections 12-13 - Image processing (video surveillance/CCTV)

BSI IT-Grundschutz · 1 control

  • BSI-17 Continuous monitoring strategy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

FISMA · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FedRAMP High · 1 control

  • IR-4 Incident Handling

FedRAMP Rev 5 · 1 control

  • FedRAMP-ConMon Continuous Monitoring (ConMon) and Significant Change Requests

Florida Digital Bill of Rights (FDBR) · 1 control

Ghana Cybersecurity Act · 1 control

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-24 Macroprudential Surveillance and Insurance Supervision

IEC 62443 · 1 control

IEEE 1686 · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

ISMAP (Japan) · 1 control

ISO 27002:2022 · 1 control

  • 8.29 Security testing in development and acceptance

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27019 · 1 control

ISO 27701:2019 · 1 control

  • 6.15.2 Information security reviews

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO/IEC 27006:2024 · 1 control

ISO/IEC 27400:2022 · 1 control

  • 27400-6.5 Security monitoring and incident response

Japan FSA Cybersecurity Guidelines for Financial Institutions · 1 control

MTCS (Singapore) · 1 control

NERC CIP · 1 control

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)

NIST SP 1800-32 · 1 control

NIST SP 800-144 · 1 control

  • NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance

NIST SP 800-145 · 1 control

  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 1 control

  • 3.12 Segment Data Processing and Storage Based on Sensitivity

NIST SP 800-172 · 1 control

  • 3.12.1e Penetration Testing by Independent Agents

NIST SP 800-190 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • IR-4 Incident Handling

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • IR-4 Incident Handling

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • IR-4 Incident Handling

NIST SP 800-53A Rev. 5 · 1 control

  • 53A-D Penetration Testing

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-5 Network Security, System Hardening, and Application Security

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-5 Information Gathering, Logging, Monitoring, and Incident Response

Oman National Cybersecurity Framework · 1 control

  • OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

UK Telecommunications (Security) Act 2021 · 1 control

US SEC Digital Assets and Crypto Regulatory Framework · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CA - Assessment, Authorization, and Monitoring

You are reading one control. How much of FedRAMP Moderate have you already done?

FedRAMP Moderate CA-8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.

If you hold ISO 27002:202256.3% covered · 141 gapsIf you hold PCI DSS 4.051.1% covered · 158 gapsIf you hold ISO 27001:202249.8% covered · 162 gapsIf you hold NIST SP 800-171 Rev 345.5% covered · 176 gapsIf you hold C5 (Germany)37.2% covered · 203 gapsIf you hold CMMC 2.035% covered · 210 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 101 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Moderate controls