Perform Periodic Internal Penetration Tests
Description
Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be clear box or opaque box.
Implementation Checklist
Tool Recommendations
Continuous security testing platform with bug bounty programs, managed pentesting, and vulnerability disclosure
HackerOne · Program-based subscription
Crowdsourced security testing platform with vetted researchers, AI-enhanced pentesting, and continuous assessment
Synack · Asset-based subscription
Pentest as a Service platform with vetted pentesters, programmatic testing, and findings management
Cobalt · Credit-based subscription
Continuous attack surface management and offensive security platform combining automated scanning with expert-led pentesting
Bishop Fox · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Lateral Movement Paths Undiscovered Until Real Breach
ConfidentialityAn attacker who gains initial internal access discovers and exploits lateral movement paths between network segments that would have been identified by an internal penetration test.
Internal Privilege Escalation to Domain Administrator
ConfidentialityAn attacker escalates from a standard user account to domain administrator using Active Directory misconfigurations that an internal penetration test would have uncovered and flagged for remediation.
Insider Threat Exploits Internal Weaknesses
ConfidentialityA malicious insider exploits weak internal segmentation, overly permissive file shares, and misconfigured services that have never been tested from an internal attacker's perspective.
Vulnerabilities (When Safeguard Absent)
Internal Network Not Tested from Attacker Perspective
Without internal penetration testing, vulnerabilities exploitable after initial access such as Active Directory misconfigurations, weak segmentation, and lateral movement paths remain undiscovered.
Assume-Breach Scenario Never Validated
Absence of internal penetration testing means the organization has never evaluated its defensive posture under the assumption that an attacker has already bypassed perimeter controls and has internal access.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Record | Penetration test report and executive summary | Per engagement |
| Record | Remediation tracking and retest validation results | Post-engagement |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |