Does CMMC require a penetration test?

Who it applies to

Defense contractors and subcontractors in the defense industrial base, with the required level set by the contract and the data handled.

In detail

CMMC Level 1 covers basic safeguarding of federal contract information with 15 practices and allows annual self-assessment. Level 2 covers controlled unclassified information against the 110 practices of NIST SP 800-171, assessed either by a certified third-party assessor organization or, for some contracts, by self-assessment. Level 3 adds enhanced requirements drawn from NIST SP 800-172 and is assessed by the government.

The absence of an explicit penetration testing practice at Level 2 surprises people, because so much of the surrounding federal ecosystem requires it. NIST SP 800-171 focuses on protecting controlled unclassified information through access control, configuration management, incident response and the rest, and leaves adversarial testing to the 800-53 and 800-172 tiers.

That said, security assessment requirements at 3.12.1 through 3.12.4 ask for periodic assessment of security controls to determine whether they are effective, and a penetration test is a defensible way to evidence that a control set works in practice rather than on paper.

What to have in scope

• Systems handling controlled unclassified information within the assessment boundary
• Evidence that supports the 3.12 security assessment practices
• Enclave boundaries, where CUI is segmented from the rest of the business