Navigate

PE-3(6)

PE-3(6): Facility Penetration Testing

The organization employs a penetration testing process that includes [organization-defined frequency], unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility.

Supplemental

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PE-3(6).

Control	Description
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [organization-defined individuals or roles].
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

Control

Description

CA-2

The organization:

a: Develops a security assessment plan that describes the scope of the assessment including:
- 1: Security controls and control enhancements under assessment;
- 2: Assessment procedures to be used to determine security control effectiveness; and
- 3: Assessment environment, assessment team, and assessment roles and responsibilities;

b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c: Produces a security assessment report that documents the results of the assessment; and

d: Provides the results of the security control assessment to [organization-defined individuals or roles].

CA-7

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

a: Establishment of [organization-defined metrics] to be monitored;

b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring;

c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

e: Correlation and analysis of security-related information generated by assessments and monitoring;

f: Response actions to address results of the analysis of security-related information; and

g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of PE-3(6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-3(6).

CCI	Definition
CCI-000934	The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency.
CCI-000935	The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility.