In NIST SP 800-53 Rev. 5, penetration testing is control CA-8 and vulnerability monitoring and scanning is control RA-5. They are separate controls on purpose. RA-5 asks you to scan and fix on an ongoing basis. CA-8 asks for periodic, human led testing that goes beyond automated scanning.
What CA-8 says
The control statement is short: conduct penetration testing at an organization defined frequency on organization defined systems or components. The discussion adds that penetration testing:
- goes beyond automated vulnerability scanning,
- is conducted by agents and teams with demonstrable skills and experience,
- can validate vulnerabilities or determine the degree of penetration resistance within constraints such as time, resources and skills,
- should follow rules of engagement agreed before testing starts,
- may expose legally protected information to testers, so contracts should cover handling.
An enhancement, CA-8(1), calls for an independent penetration testing agent or team.
What RA-5 says
RA-5 asks organizations to:
- monitor and scan for vulnerabilities at a defined frequency, and when new vulnerabilities affecting the system are reported,
- use tools that support interoperability and automation, using standards for identifying flaws and measuring impact,
- analyze scan results,
- remediate legitimate vulnerabilities within defined response times based on risk,
- share what was learned to help eliminate similar issues elsewhere,
- use tools that can be updated readily with new vulnerabilities.
The discussion notes that custom software may need additional approaches such as static analysis, dynamic analysis and binary analysis.
Side by side
| Point | CA-8 penetration testing | RA-5 vulnerability scanning |
|---|---|---|
| Rhythm | Periodic, you define the frequency | Ongoing, and when new vulnerabilities are reported |
| Who | People with demonstrable skills | Tools, with analysis by staff |
| Output | Findings with exploitation evidence | Scan results to analyze and fix |
| Link | Can use scan results as input | Can take new leads from red team style assessments |
Note that both frequencies are "organization defined." The control does not set a number. Whatever you choose, document it and be able to explain it.
How to show both in an assessment
- State your scan frequency and what it covers.
- Keep scan reports and remediation records with dates.
- State your pen test frequency and scope, and keep the report and retest evidence.
- Show how findings from one fed the other.
- Map both to the control IDs in your evidence index.
Try it yourself
Open the demo and look at how findings and evidence are mapped to framework controls. Think about what you would attach to RA-5 and what to CA-8.
Click through it at your own pace, or open it full screen.
Quick check
Does 800-53 say how often to pen test?
No. CA-8 leaves the frequency to the organization, so choose one and document why.
Can scanning satisfy CA-8?
The control discussion says penetration testing goes beyond automated vulnerability scanning, so scan results alone are not what CA-8 describes.
Safeguard supports the evidence side with SBOM and dependency scanning plus compliance and evidence automation. A free scan shows the scanning side.
Sources
Last reviewed: 19 October 2026.
