CA-8(3) Facility Penetration Testing
Control enhancement of CA-8 Penetration Testing
Control
Employ a penetration testing process that includes [Assignment: frequency] [Assignment: Selection (one-or-more): announced | unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.
Discussion
Penetration testing of physical access points can provide information on critical vulnerabilities in the operating environments of organizational systems. Such information can be used to correct weaknesses or deficiencies in physical controls that are necessary to protect organizational systems.
Related controls
Need CA-8(3) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.