Red Team Exercises
LOW MODERATE HIGHRequirements NIST SOURCE
Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [red team exercises].
Discussion (NIST Supplemental Guidance)
Red team exercises extend the objectives of penetration testing by examining the security and privacy posture of organizations and the capability to implement effective cyber defenses. Red team exercises simulate attempts by adversaries to compromise mission and business functions and provide a comprehensive assessment of the security and privacy posture of systems and organizations. Such attempts may include technology-based attacks and social engineering-based attacks. Technology-based attacks include interactions with hardware, software, or firmware components and/or mission and business processes. Social engineering-based attacks include interactions via email, telephone, shoulder surfing, or personal conversations. Red team exercises are most effective when conducted by penetration testing agents and teams with knowledge of and experience with current adversarial tactics, techniques, procedures, and tools. While penetration testing may be primarily laboratory-based testing, organizations can use red team exercises to provide more comprehensive assessments that reflect real-world conditions. The results from red team exercises can be used by organizations to improve security and privacy awareness and training and to assess control effectiveness.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for CA-8(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- red team exercises to simulate attempts by adversaries to compromise organizational systems are defined;
- <CA-08(02)_ODP red team exercises> are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.
Examine
[SELECT FROM: Assessment, authorization, and monitoring policy; procedures addressing penetration testing; procedures addressing red team exercises; assessment plan; results of red team exercises; penetration test report; assessment report; rules of engagement; assessment evidence; system security plan; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with assessment responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators].
Test
[SELECT FROM: Mechanisms supporting the employment of red team exercises].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for CA-8(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Assessment, authorization, and monitoring policy
- assessment plan
- system security plan
- privacy plan
Testing
- Mechanisms supporting the employment of red team exercises
Other Records
- procedures addressing penetration testing
- procedures addressing red team exercises
- results of red team exercises
- penetration test report
- assessment report
- rules of engagement
- assessment evidence
- other relevant documents or records