CCI-002096

Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components.

Implementation Guidance

The organization being inspected/assessed employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components. The organization must maintain a record of penetration test results.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines a sampling of the penetration test results to ensure the organization being inspected/assessed employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.

Compelling Evidence

1.) SOP/TTP documenting the employment of an independent penetration agent or penetration team to perform penetration testing on information systems or system components. 2.) Penetration testing results

The controls below (if any) were marked by NIST as being related to CCI-002096.