CIS Controls v8 18.5 — Perform Periodic Internal Penetration Tests

What this control requires

Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be clear box or opaque box.

In plain English

Perform periodic internal penetration tests based on program requirements, no less than annually. In practice, this means you can prove you perform periodic internal penetration tests-level controls on a defined cadence.

Why it matters

The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care.

What an auditor looks for

A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands.

Within Identify, the assessor will trace your implementation back to the catalogue reference (Control 18.5) and look for objective evidence on the latest two assessment cycles.

How to implement

Code Review Testing

Pipeline. Require at least one human reviewer plus passing CI (lint, type, unit, security scan) before merge — protected branches enforce this.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Perform. Document the trigger, the owner and the cadence.
• Scope: periodic internal penetration tests.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Perform Periodic Internal Penetration Tests.

Common pitfalls

• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• ISO/IEC 27001:2022 A.8.33 — Test information

Related controls in CIS Controls v8

• Control 18.2 — Perform Periodic External Penetration Tests
• Control 18.1 — Establish and Maintain a Penetration Testing Program
• Control 7.5 — Perform Automated Vulnerability Scans of Internal Enterprise Assets
• Control 7.6 — Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
• Control 2.2 — Ensure Authorized Software is Currently Supported
• Control 5.5 — Establish and Maintain an Inventory of Service Accounts

References

• Center for Internet Security — CIS Controls v8
• Catalogue identifier: Control 18.5

Topics: governance riskcode review testingpolicy management