NIST 800-53 REV 5 • ASSESSMENT, AUTHORIZATION, AND MONITORING
CA-8(3) — Facility Penetration Testing
Employ a penetration testing process that includes {{ insert: param, ca-08.03_odp.01 }} {{ insert: param, ca-08.03_odp.02 }} attempts to bypass or circumvent controls associated with physical access points to the facility.
Supplemental Guidance
Penetration testing of physical access points can provide information on critical vulnerabilities in the operating environments of organizational systems. Such information can be used to correct weaknesses or deficiencies in physical controls that are necessary to protect organizational systems.
Practitioner Notes
This enhancement extends penetration testing to your physical facilities — testing whether someone could gain unauthorized physical access to your servers, network equipment, or data center.
Example 1: Hire a physical penetration testing team to attempt to bypass your badge readers, tailgate through secure doors, and access your server room without authorization.
Example 2: Test whether your security guards and reception staff follow proper visitor verification procedures by sending testers posing as delivery personnel or maintenance workers.