NIST SP 800-53A Rev. 5 53A-D: Penetration Testing

What else in your programme already covers this

This control maps to 19 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 3 controls

CIS-18.1 Establish and Maintain a Penetration Testing Program
CIS-18.2 Perform Periodic External Penetration Tests
CIS-18.5 Perform Periodic Internal Penetration Tests

FedRAMP High · 3 controls

CA-8 Penetration Testing
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))
CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2))

FedRAMP Moderate · 3 controls

CA-8 Penetration Testing
CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))
CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2))

PCI DSS 4.0 · 3 controls

11.4.1 11.4.1 Penetration testing methodology defined and implemented
11.4.2 11.4.2 Internal penetration testing annually and after change
11.4.3 11.4.3 External penetration testing annually and after change

Azure Security Benchmark · 2 controls

ASBv3-PV-7 Conduct regular red team operations
PV-5 Perform vulnerability assessments

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-TVM-06 Penetration Testing

ISO 27001:2022 · 1 control

8.34 Protection of information systems during audit testing

ISO 27002:2022 · 1 control

8.34 Protection of information systems during audit testing

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-ID.IM-01 Improvements are identified from evaluations

NIST SP 800-53 Rev 5 · 1 control

NIST800-CA-8 CA-8 Penetration Testing

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.