Annual penetration testing of your FedRAMP authorization boundary per NIST SP 800-115. Rules of Engagement documentation, findings mapped to NIST SP 800-53 controls, and a deliverable package your 3PAO and agency sponsor accept without revision cycles.
FedRAMP Moderate and High baselines both mandate annual penetration testing. The requirements are in NIST SP 800-53 and the FedRAMP security controls baseline.
Requires annual penetration testing of the authorization boundary. Applies to Moderate (CA-8(1) also requires privileged-access testing) and High baselines. The test must follow an approved methodology — NIST SP 800-115 is the FedRAMP standard. Results feed the Plan of Action and Milestones (POA&M).
Requires security testing during development and before deployment of new system components. For cloud service providers adding features to a FedRAMP-authorized system, this means testing before the change goes into the authorization boundary. Significant changes (SCR process) often trigger SA-11 evidence.
Separate from CA-8. Requires regular automated vulnerability scanning of the authorization boundary — quarterly for Moderate, monthly for High. RA-5 is automated scanning; CA-8 is manual penetration testing. Both are required and neither satisfies the other.
Critical flaws must be remediated within 30 days, high within 90 days. Penetration test findings populate the POA&M and trigger SI-2 timelines. The retest report closes POA&M items. We time our retest delivery to your POA&M update cycle.
FedRAMP penetration testing has formal pre-engagement documentation requirements. Skipping any one of them puts the ATO at risk.
FedRAMP Moderate and High share CA-8, but the High baseline adds requirements that change the engagement depth and duration.
CA-8 annual pentest of the authorization boundary. External and internal. NIST SP 800-115 methodology. Findings in POA&M format. CA-8(1) (privileged-access testing) is not required at Moderate — but frequently included because the 3PAO recommends it.
CA-8 plus CA-8(1) (privileged-access testing with elevated credentials). Broader scope, deeper testing of insider threat paths and administrative access controls. Higher frequency of continuous monitoring activities. Red team exercises may be expected by the agency sponsor.
Additions or changes to the authorization boundary trigger the Significant Change Request process. SA-11 may require security testing before the change is approved. We can run targeted tests scoped to the new component to satisfy SCR evidence requirements without a full annual engagement.
The 3PAO performs an annual security assessment as part of continuous monitoring. The CA-8 penetration test is typically coordinated with this cycle. We deliver test results in time for the 3PAO's annual assessment report — coordinating timing at the scoping call.
What cloud service providers ask before FedRAMP penetration testing. See network penetration testing for infrastructure-layer testing that often accompanies FedRAMP engagements.
CA-8 is the primary control — annual penetration testing of the authorization boundary. SA-11 covers security testing during development. RA-5 covers vulnerability scanning (separate from the pentest). All three are required for FedRAMP Moderate and High. They are distinct requirements and cannot be satisfied by a single activity.
For the initial ATO, the 3PAO typically performs or directly oversees the penetration test. For annual continuous monitoring, an independent tester — not necessarily a 3PAO — can perform the test, with the 3PAO reviewing results as part of the annual assessment. We coordinate directly with your 3PAO on timing and deliverable format.
NIST SP 800-115 is the required methodology reference. The Rules of Engagement document must cite it. Each phase (planning, discovery, attack, reporting) must be documented. Testers who produce a report without a clear SP 800-115 phase structure create evidence gaps that the 3PAO has to explain to JAB reviewers.
Each finding in our report includes the NIST SP 800-53 control reference, severity (mapped to FedRAMP risk thresholds), recommended remediation, and a suggested scheduled completion date consistent with FedRAMP remediation timelines (30 days for Critical, 90 days for High). You merge this directly into the POA&M template without reformatting.
We can run a targeted test scoped to the new component to generate SA-11 evidence for the SCR package. This is a shorter engagement than the annual CA-8 test — scoped to the delta, not the full boundary. Timing is coordinated with your SCR submission deadline and 3PAO review cycle.
Scoping call covers your baseline (Moderate or High), authorization boundary, 3PAO coordination, and annual assessment calendar. 30 minutes. Free.