What Does FedRAMP Require, and Where Does Penetration Testing Fit?
FedRAMP is a government-wide, standardized approach to security assessment and authorization for cloud services used by federal agencies, established in law by the FedRAMP Authorization Act of 2022 and administered by the General Services Administration (GSA). Rather than each agency independently assessing every cloud provider it wants to use, FedRAMP creates a single, reusable authorization that other agencies can rely on.
As of 2026, FedRAMP operates two active tracks:
- Rev5, the established baseline built on NIST SP 800-53 controls and Low, Moderate, High, and LI-SaaS impact levels. This is the model most currently authorized cloud service offerings operate under.
- FedRAMP 20x, a newer certification model rolling out in phases since March 2025, organized into Certification Classes (Class A, B, and C are available now; Class D, aimed at High-impact services, is planned for a later phase) and built around continuously validated Key Security Indicators rather than a static, point-in-time control checklist.
FedRAMP has published a timeline to stop accepting new Rev5 certifications in mid-2027, with a transition path for cloud services already authorized under Rev5. New authorizations are increasingly pursuing the 20x path, while many currently authorized systems still operate under Rev5 today. Both tracks currently expect independent, adversarial testing as part of how a provider demonstrates its controls work, though the specific mechanics differ.
How Does Penetration Testing Support the Traditional Rev5 Authorization Process?
Under the Rev5 baseline, penetration testing supports several NIST SP 800-53 control families tied to assessment, vulnerability management, and boundary protection:
| Control | What it requires |
| CA-8 (Penetration Testing) | Requires the organization to conduct penetration testing to identify exploitable weaknesses and validate the effectiveness of security controls under realistic attack conditions. |
| CA-2 (Control Assessments) | Requires periodic security assessments to evaluate whether controls are properly implemented, operating as intended, and producing the desired security outcomes. |
| RA-5 (Vulnerability Monitoring and Scanning) | Requires continuous vulnerability scanning to identify known weaknesses. |
| SI-2 (Flaw Remediation) | Requires timely remediation of identified vulnerabilities and verification of corrective actions. |
Findings from Rev5 penetration testing are documented in the Security Assessment Report (SAR) and tracked in the Plan of Action and Milestones (POA&M) until remediation is verified. A Third-Party Assessment Organization (3PAO) independently performs or verifies this testing, and the results feed the risk determination that an agency’s authorizing official relies on to grant or maintain an ATO. Under Rev5, penetration testing is required at least annually and again after significant changes to the system, alongside ongoing continuous monitoring obligations.
How Does Penetration Testing Fit into FedRAMP 20x?
FedRAMP 20x replaces the standalone Security Assessment Plan and Security Assessment Report model with a leaner structure built around two assurance rulesets that matter most for testing:
- Independent Verification and Validation (IVV). Providers must complete a FedRAMP independent assessment, performed by a FedRAMP Recognized independent assessment service, at least once a year covering all applicable Key Security Indicators. The assessor verifies that documented controls are actually implemented and validates that they are effective, and the results are summarized directly in the provider’s Security Decision Record and Certification Package Overview rather than in a separate SAR.
- Vulnerability Evaluation and Reporting (VER). Providers must continuously detect, evaluate, and report on vulnerabilities, including an estimate of exploitability, internet-reachability, and potential agency impact for each one. FedRAMP’s own guidance for this ruleset specifically expects providers’ periodic activity summaries to include penetration testing alongside other vulnerability-detection activity such as bug bounty programs, vulnerability disclosure programs, and other assessments.
The practical difference from Rev5 is one of structure rather than intent. Instead of one named control requiring an annual penetration test, FedRAMP 20x expects continuous vulnerability detection and response, validated once a year through an independent assessment of the Key Security Indicators, of which authorized adversarial testing is typically one input. A provider moving to 20x should not assume penetration testing is no longer expected; it should confirm with its independent assessor how testing evidence is being folded into the Key Security Indicators and vulnerability reporting it now has to produce.
| Evaluation principle Whichever FedRAMP track applies, the question that matters is not simply whether a penetration test was run. It is whether the organization can produce defensible, independently verified evidence that its controls resist real attack techniques and that it understands its current exposure. Rev5 and FedRAMP 20x package that evidence differently, but neither track treats a penetration test as optional. |
Rev5 and FedRAMP 20x Side by Side
| Dimension | Rev5 baseline | FedRAMP 20x |
| Assessment structure | Security Assessment Plan and Security Assessment Report produced by a 3PAO. | Independent assessment results summarized in a Security Decision Record and Certification Package Overview. |
| Testing cadence | Annual penetration test plus reassessment after significant change (CA-8). | Annual independent assessment covering all Key Security Indicators; vulnerability evaluation and reporting run continuously. |
| Independent assessor | Third-Party Assessment Organization (3PAO). | FedRAMP Recognized independent assessment service (FedRAMP direct assessment is rare and reserved for prioritized services). |
| Impact or class structure | Low, Moderate, High, and LI-SaaS impact levels. | Certification Class A, B, and C available now; Class D (High-impact) planned for a later phase. |
| Findings tracking | Security Assessment Report and Plan of Action and Milestones (POA&M). | Persistent vulnerability reporting with exploitability and potential agency impact ratings for each finding. |
How Does Penetration Testing Differ from Vulnerability Scanning in a FedRAMP Context?
Penetration testing differs from vulnerability scanning because it confirms exploitability, while scanning identifies known weaknesses. Both are required inputs to a FedRAMP authorization, and neither replaces the other.
| Requirement area | Vulnerability scanning | Penetration testing |
| Primary objective | Identify known flaws. | Confirm exploit paths. |
| Rev5 control alignment | RA-5. | CA-8 and CA-2. |
| Methodology | Automated tools. | Manual and automated adversarial techniques. |
| Output | A list of potential issues. | Validated exploitation scenarios. |
| Role under FedRAMP 20x | Feeds Vulnerability Evaluation and Reporting continuously. | One input assessors typically rely on to validate Key Security Indicators. |
Understanding this distinction matters because overreliance on automated detection alone leaves a gap: a scanner can tell an organization that a weakness might exist, but only validated testing tells it whether that weakness is actually exploitable in the deployed environment.
What Evidence Does Penetration Testing Produce for a FedRAMP Authorization Package?
Specific areas where penetration testing supports a FedRAMP authorization include:
- Identifying exploitable weaknesses within in-scope systems.
- Validating network segmentation and boundary protections.
- Confirming identity and access enforcement mechanisms.
- Assessing potential impact on federal data.
Under Rev5, validated findings are documented in the Security Assessment Report and tracked in the POA&M with defined remediation timelines; findings remain open until remediation is verified through retesting. Under FedRAMP 20x, the same underlying evidence instead flows into the provider’s persistent vulnerability reporting and into the independent assessor’s annual summary of Key Security Indicator performance, which becomes part of the Security Decision Record.
What Scope Must Penetration Testing Cover in a FedRAMP Environment?
Penetration testing in a FedRAMP environment must align with the defined authorization boundary and include all systems that could affect regulated federal data. Typical coverage includes:
- Internet-facing interfaces and APIs.
- Cloud infrastructure components and management planes.
- Identity providers and privileged access pathways.
- Network segmentation and boundary controls.
- Interconnected systems affecting the authorization boundary.
Testing should reflect the system’s actual operational footprint rather than a narrow, convenient subset of components. Proper scope alignment ensures the resulting evidence reflects real risk exposure rather than a partial picture.
How Often Must Penetration Testing Occur for FedRAMP Compliance?
Under Rev5, FedRAMP requires annual penetration testing and reassessment after significant changes to the system, alongside continuous monitoring obligations that require ongoing validation of risk posture.
Under FedRAMP 20x, the annual independent assessment must cover all applicable Key Security Indicators, and vulnerability evaluation and reporting run on an ongoing basis rather than on a fixed testing calendar. In practice, this means testing-derived evidence needs to be current enough to support monthly vulnerability reporting and rapid evaluation timeframes, not just a once-a-year snapshot.
Organizations should confirm the specific cadence expectations that apply to their authorization path and any sponsoring agency, since the transition between Rev5 and 20x is still actively underway.
Readiness Questions Before a FedRAMP Penetration Test
☐ We know which FedRAMP track (Rev5 or FedRAMP 20x) applies to our authorization.
☐ We can map our authorization boundary to the systems that must be in scope for testing.
☐ We have identified whether our independent assessor is a 3PAO or a FedRAMP Recognized independent assessment service.
☐ We understand how testing evidence will be documented, whether in a SAR/POA&M or in persistent vulnerability reporting and a Security Decision Record.
☐ We have a remediation and retesting process that meets our required timelines.
☐ We have confirmed current program details against FedRAMP.gov rather than relying on older guidance.