Requires penetration testing to be conducted on organization-defined systems or components at an organization-defined frequency, so that control effectiveness is tested by simulated adversary activity rather than by inspection alone.
What else in your programme already covers this
This control maps to 116 controls across 61 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
6.2.3 Custom software reviewed prior to production
6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components
CA-8(2) Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?
NIST SP 800-53 Rev 5 NIST800-CA-8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 300 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.