2026/reference/controls/assessment-authorization-and-monitoring/

[giscus[bot]]

2026/reference/controls/assessment-authorization-and-monitoring/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/reference/controls/assessment-authorization-and-monitoring/?h=ca-08

[cbaerschellman]

Hi team - if CA-8 notes "Penetration testing is part of vulnerability detection and is subject to the Vulnerability Detection and Response rules." but the Vulnerability Detection and Response rules do not mandate a penetration test, can you clarify if a penetration is explicitly required?

[pete-gov]

Penetration testing is no longer explicitly required in CR26.

A holistic detection and response program is required in the VDR - specific techniques are not. Penetration testing is one aspect of vulnerability detection that could be a part of a holistic detection and response program, but is not required on its own. See VDR-CSO-DET Vulnerability Detection.

Persistent penetration testing likely increases assurance and a strong penetration testing program that includes automated routine testing combined with high level engagements is something many agency customers may look for in a cloud service offering.

Providers following the Rev5 CR26 rules must document their approach to this aspect of vulnerability detection and response in their CA-8 narratives, and explain how that approach affects risk in their system. A provider with sufficient compensating capabilities documented in their controls and VDR response rules will be able to receive a FedRAMP Certification without performing any penetration testing at all.