Navigate

CA-8 (1)

CA-8 (1): Independent Penetration Agent Or Team

The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.

Supplemental

Independent penetration agents or teams are individuals or groups who conduct impartial penetration testing of organizational information systems. Impartiality implies that penetration agents or teams are free from any perceived or actual conflicts of interest with regard to the development, operation, or management of the information systems that are the targets of the penetration testing. Supplemental guidance for CA-2 (1) provides additional information regarding independent assessments that can be applied to penetration testing.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer)

Related Controls

The controls below (if any) were marked by NIST as being related to CA-8 (1).

Control	Description
CA-2	The organization: CA-2a.: Develops a security assessment plan that describes the scope of the assessment including: CA-2a.1.: Security controls and control enhancements under assessment; CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities; CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; CA-2c.: Produces a security assessment report that documents the results of the assessment; and CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].

Control

Description

CA-2

The organization:

CA-2a.: Develops a security assessment plan that describes the scope of the assessment including:
- CA-2a.1.: Security controls and control enhancements under assessment;
- CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and
- CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities;

CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

CA-2c.: Produces a security assessment report that documents the results of the assessment; and

CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].

Enhancements

The controls below (if any) add on to the requirements of CA-8 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CA-8 (1).

CCI	Definition
CCI-002096	The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.