31 October 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
FedRAMP Penetration Testing: What Rev. 5 Control CA-8 and the Penetration Test Guidance Require from a Cloud Service Provider
A cloud service provider cannot hold a FedRAMP authorization without an annual penetration test performed by its Third Party Assessment Organization, covering six prescribed attack vectors, and since Rev. 5 an annual red team exercise on top. This guide explains the controls, the vectors, who may perform what, and how to prepare so the 3PAO's test confirms rather than discovers.
What FedRAMP is and who it applies to
The Federal Risk and Authorization Management Program (FedRAMP) is the US government's standardised approach to assessing, authorising and continuously monitoring cloud services used by federal agencies. It began as an OMB policy in 2011 and became statute with the FedRAMP Authorization Act of December 2022. Any cloud service provider (CSP) that wants a federal agency to store or process federal information in its service needs a FedRAMP authorization at the Low, Moderate or High impact level, with Moderate covering the large majority of authorised services.
The security baselines are drawn from NIST SP 800-53. FedRAMP moved to Revision 5 of that catalogue in 2023, and the Rev. 5 baselines are what every CSP is assessed against today. Authorization is granted by an agency (the former Joint Authorization Board path has been retired in favour of agency authorizations under the FedRAMP Board). Independent assessment is performed by a Third Party Assessment Organization (3PAO), accredited by the American Association for Laboratory Accreditation (A2LA) to ISO/IEC 17020 plus FedRAMP-specific requirements. The 3PAO produces the Security Assessment Report (SAR); the penetration test is a mandatory section of it.
For a European software company the route into this market normally runs through a US entity and a US-hosted instance of the platform, because agencies expect the authorization boundary, the data and the support personnel to be documented to FedRAMP's standards. The engineering and security work, however, can be done anywhere, which is where a European testing partner becomes relevant.
The Rev. 5 controls that govern penetration testing
Penetration testing sits in the Assessment, Authorization and Monitoring family (CA), supported by vulnerability management controls in the Risk Assessment family (RA).
CA-8: Penetration testing, at least annually
Control CA-8 requires the CSP to conduct penetration testing on the systems in the authorization boundary. FedRAMP sets the frequency parameter at least annually, and additionally requires a test as part of the initial authorization and after significant changes that alter the attack surface. The test must be conducted by the 3PAO as part of the assessment, and the methodology must follow the FedRAMP Penetration Test Guidance, including all applicable attack vectors.
CA-8(1): Independent penetration testing agent or team
The enhancement requires that the testers be independent of the system they test, which FedRAMP satisfies by requiring the 3PAO to perform the test. The 3PAO must itself be free of conflicts: it may not have designed, implemented or advised on the security controls of the system it assesses. A CSP's own security team, or a consultancy that helped build the controls, cannot perform the authorization test.
CA-8(2): Red team exercises, added in Rev. 5
New in the FedRAMP Rev. 5 Moderate and High baselines, CA-8(2) requires red team exercises that simulate attempts by adversaries to compromise the system, at least annually. Where the CA-8 penetration test is vector-driven and broad, the red team exercise is objective-driven: can an adversary reach federal data or the management plane without being detected and stopped? The results feed the annual assessment, and the 3PAO reviews the exercise and its evidence.
RA-5, CA-7 and CA-2: the controls around the test
RA-5 requires authenticated vulnerability scanning of operating systems, databases, web applications and containers at least monthly, with results reported in continuous monitoring (CA-7) and tracked to closure in the Plan of Action and Milestones. CA-2 requires the annual control assessment of which the penetration test is a part. A CSP whose monthly scanning is weak tends to have a long penetration test report; the two controls are meant to work together.
The six attack vectors in the FedRAMP Penetration Test Guidance
The guidance prescribes the perspectives from which the 3PAO must test. Every vector that applies to the service is mandatory, and the SAR must explain why any vector was excluded.
1. External to corporate
Social engineering of CSP staff, principally phishing, to test whether an attacker can gain a foothold in the corporate environment that administers the cloud service. Includes credential harvesting and malicious attachment or link scenarios against a sample of employees with access to the system.
2. External to CSP target system
Unauthenticated attack from the internet against every externally exposed component in the authorization boundary: web front ends, APIs, authentication endpoints, management portals, DNS and mail services. The classic external penetration test, scoped to the full boundary rather than a sample.
3. Tenant to CSP management system
Authenticated attack from a customer tenant toward the provider's management plane: can a tenant user escalate to CSP-side administration, reach orchestration or hypervisor layers, or read configuration and secrets that belong to the provider? The vector that distinguishes cloud testing from ordinary application testing.
4. Tenant to tenant
Authenticated attack from one tenant toward another: data isolation, authorisation at the object level, shared caches, message queues, storage buckets and logging pipelines. Multi-tenant isolation failures are the findings agencies fear most, because one tenant may be a federal agency and the other anyone.
5. Mobile application to target system
Where the service offers a mobile application, testing of the iOS and Android clients and their communication with the back end: local storage, certificate validation, authentication tokens, and the API surface the app exposes. Follows OWASP MASVS v2 and MASTG in practice.
6. Client-side application or agents to target system
Where the service relies on installed software, browser extensions or agents on customer systems, testing of that code and its channel to the service: update mechanisms, local privilege, stored credentials and the trust the back end places in what the client reports.
Who does what: CSP, 3PAO, independent tester and agency
FedRAMP is precise about roles. Confusing them is the fastest way to have a penetration test rejected from the authorization package.
| Activity | Who performs it | Notes |
|---|---|---|
| Authorization penetration test (CA-8) for the SAR | The 3PAO | Mandatory; follows the Penetration Test Guidance; results in the SAR with a retest of remediated findings |
| Annual penetration test in continuous monitoring | The 3PAO | Part of the annual assessment; same vectors; same independence rules |
| Pre-assessment or readiness penetration test | An independent testing firm or qualified internal team | Not part of the package; used to find and fix before the 3PAO tests; strongly recommended before the first authorization |
| Red team exercise (CA-8(2)) | An independent red team; 3PAO reviews the exercise and evidence | Objective-based, annual; confirm with your 3PAO and agency how the evidence is presented in the annual assessment |
| Monthly vulnerability scanning (RA-5) | The CSP | Authenticated scans; results in the monthly ConMon deliverables; POA&M for open items |
| Testing after significant changes | The CSP, with 3PAO involvement where the Significant Change Request requires it | A new externally exposed component or a change to authentication typically triggers 3PAO testing |
| Acceptance of the authorization package | The authorizing agency | Reviews the SAR including the penetration test; may require additional testing |
What a CSP must prepare before the penetration test
The 3PAO's test is time-boxed. Every day spent provisioning access or clarifying the boundary is a day not spent testing, and gaps in preparation appear in the SAR as limitations.
- An authorization boundary diagram and data-flow diagram that match the System Security Plan (SSP) exactly, listing every externally exposed component and every interconnection
- Signed rules of engagement covering the six vectors, the testing window, emergency contacts, the production or production-equivalent environment to be tested, and how denial-of-service style tests are excluded
- Test accounts for at least two separate tenants, with multiple roles in each, so tenant-to-tenant and tenant-to-management vectors can be exercised
- Administrative and read-only accounts for the management plane where the guidance requires an authenticated review of the CSP side
- Current mobile application builds for each supported platform, with test accounts and any required device enrolment
- Installers or packages for any client-side software or agents, with documentation of their update and authentication mechanisms
- A list of in-scope staff for the social engineering vector, agreed with HR and legal, with a defined success criterion that does not require executing malware
- The latest monthly vulnerability scan results and POA&M, so the test can focus on exploitation and chaining rather than on rediscovering known items
- The previous year's penetration test report and retest evidence, which the 3PAO will compare against to confirm closure
FedRAMP 20x and what is changing
In March 2025 the FedRAMP programme office announced FedRAMP 20x, a modernisation effort intended to replace much of the document-heavy authorization process with machine-readable evidence, Key Security Indicators and continuous validation, beginning with a pilot for Low-impact SaaS and extending to Moderate. OMB memorandum M-24-15 of July 2024 set the policy direction: faster authorizations, more automation, and a stronger role for agencies and for CSPs' own continuous assurance. As of late 2026 the programme is in transition: Rev. 5 remains the baseline against which authorizations are issued and assessed, while 20x pilots define how evidence will be collected and validated in future.
What does not change under 20x is the need for adversarial testing. The Key Security Indicators being developed still expect a CSP to demonstrate that its boundary withstands attack, that tenants are isolated and that the management plane is protected, and the programme has signalled that penetration testing and red teaming remain part of the evidence set. CSPs that treat the annual 3PAO test as a once-a-year event will find the shift to continuous validation harder than CSPs that already test between assessments.
How a European testing firm supports a US cloud service provider
We do not perform the authorization penetration test; that is the 3PAO's role, and independence requires it to stay there. What we do is make sure the 3PAO's test confirms a clean environment. Before the initial assessment and ahead of each annual assessment, we run a readiness penetration test that follows the same six attack vectors and the same FedRAMP guidance the 3PAO will use, so the CSP fixes findings on its own timeline rather than under POA&M deadlines. Between assessments we test new features, new APIs and significant changes before they are released into the boundary. For CA-8(2) we design and execute the annual red team exercise with objectives agreed with the CSP's security lead, and we produce evidence in the form the 3PAO needs to review it.
Two practical notes for US CSPs working with a non-US firm. First, some agency and Department of Defense impact-level requirements restrict access to federal data to US persons; readiness testing is normally performed against a production-equivalent environment without federal data, which removes the issue, but confirm the constraint with your agency before granting any access. Second, our reports map findings to NIST SP 800-53 Rev. 5 control identifiers and to the FedRAMP vector they fall under, so your SSP, POA&M and SAR narratives line up without rework. Testers are OSCP-certified and named in the report. HackersHub is based in Amsterdam, Netherlands and tests US-hosted environments remotely within agreed windows.
Frequently asked questions
Want the 3PAO's test to confirm rather than discover?
We run readiness testing across all six FedRAMP vectors, test changes between assessments and deliver the annual CA-8(2) red team exercise with evidence your 3PAO can review. Talk to an expert.