BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CA-08(01) Independent Penetration Testing Agent or Team

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged CA High baseline part of CA-8

Title

Independent Penetration Testing Agent or Team

Control

Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.

Discussion

Independent penetration testing agents or teams are individuals or groups who conduct impartial penetration testing of organizational systems. Impartiality implies that penetration testing agents or teams are free from perceived or actual conflicts of interest with respect to the development, operation, or management of the systems that are the targets of the penetration testing. [CA-2(1)](#ca-2.1) provides additional information on independent assessments that can be applied to penetration testing.

Related controls

ca-2

Assessment objective

CA-08(01) an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).