NIST 800-53 r5 · Controls catalogue · Family CA
CA-8Penetration Testing
Conduct penetration testing {{ insert: param, ca-08_odp.01 }} on {{ insert: param, ca-08_odp.02 }}.
Last updated: 04 July 2026 08:17 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 51,666 | Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation. |
CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 23,326 | Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses. |
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,506 | Penetration testing attempts to access or extract sensitive data, revealing exposure of sensitive information to unauthorized actors. |
CWE-284 | Improper Access Control | 5,385 | Penetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses. |
CWE-287 | Improper Authentication | 4,909 | Penetration testing probes authentication mechanisms for bypasses, allowing identification and fixing of improper authentication issues. |
CWE-502 | Deserialization of Untrusted Data | 3,448 | Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions. |
CWE-918 | Server-Side Request Forgery (SSRF) | 3,207 | Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation. |
CWE-611 | Improper Restriction of XML External Entity Reference | 1,522 | Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||