# FedRAMP penetration testing: who may test and how often

Source: https://penetrationtestservices.com/guides/fedramp-penetration-testing/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

FedRAMP penetration testing: a 3PAO runs the official test. What the guidance says, which document applies in 2026, timing, scope, and how to prepare.

> **Short answer:** FedRAMP penetration testing under the v3 guidance is done by a third-party assessment organization (3PAO), not by the cloud provider or an ordinary vendor. The control is CA-08. Timing, scope and the governing document changed in 2026, so check fedramp.gov before you plan. A pre-assessment pentest by another party helps you fix flaws first, but it does not count as the official test.

FedRAMP penetration testing is an official test inside the US federal cloud authorization process. A third-party assessment organization (3PAO) performs it. If you sell a cloud service to US agencies, you plan for that test, and you can fix many flaws before it starts.

## Short answer: FedRAMP needs a 3PAO-led penetration test

FedRAMP's penetration test guidance, version 3, says all penetration test activities must be performed by a 3PAO. FedRAMP control CA-08 (Penetration Testing) is the matching control. The cloud service provider (CSP) scopes the system, the 3PAO tests it and reports the results, and the CSP fixes what the report finds.

This page does not give legal or compliance advice. It reflects FedRAMP pages and the v3 guidance as we found them on 9 November 2026. The v3 PDF's text layer could not be re-read that day. The quotes below come from a research note of 8 November 2026 and are marked "as reported".

## Which FedRAMP document applies today?

We could not confirm which document governs new authorizations. Here is what we checked on 9 November 2026.

| Item | Status checked 9 Nov 2026 |
|---|---|
| FedRAMP Penetration Test Guidance v3 | Dated 30 June 2022 by search listing. Hosted on fedramp.gov, file modified 8 July 2025 |
| Draft v4.0 | Dated 4 March 2024, released for public comment. No finalized version found |
| 2026 ruleset (published 24 June 2026) | CA-08 note: "Penetration testing is part of vulnerability detection and is subject to the Vulnerability Detection and Response rules" |
| Independent verification and validation page | Class B, C and D providers must complete an independent assessment at least once per year |
| Old docs/rev5 paths | Redirect to a legacy page |

FedRAMP restructured its site in 2026, so do not rely on old links. Ask your 3PAO and your FedRAMP contact which text applies to your impact level and your authorization route.

## Who may perform the test, and how is a vendor pre-test different?

Under v3, as reported, the 3PAO performs all test activities, and the team lead must hold an industry-recognized penetration testing credential. A CSP cannot self-certify, and a general security vendor cannot sell the official test unless it is a recognized assessor.

A pre-assessment test by another party has a different job. It finds flaws so you can fix them before the 3PAO arrives. The 3PAO then spends its time confirming rather than discovering. It does not count as the FedRAMP test, and no report from us will be presented as one.

Excession Labs is a security lab and not a 3PAO. We do not claim FedRAMP-ready testing, and we do not claim any assessor accepts our reports.

## Timing: initial authorization and annual testing

As reported from the v3 guidance, the first test happens no more than six months before the CSP submits the security assessment report (SAR). Later tests happen at least every 12 months.

The 2026 independent verification and validation page asks Class B, C and D providers to complete an independent assessment at least once per year. It lists CA-08 (Penetration Testing) for Class B. It lists CA-08 (01), an independent penetration testing agent or team, and CA-08 (02), red team exercises, for Class C and D. CA-08 does not appear in the 20x rules.

Plan the calendar backward from your SAR date: pre-test, fixes, retest, then the 3PAO window.

## Scope: attack vectors and rules of engagement

The v3 guidance, as reported, requires rules of engagement developed under NIST SP 800-115 Appendix B and approved by the authorizing official before testing. NIST SP 800-115 was published in 2008 and is still listed as final. The guide also lists mandatory attack vectors. We could not re-read that list on 9 November 2026, so take the current list from the PDF or from your 3PAO.

Your part of the scope is to give the 3PAO an exact boundary. Use this table to prepare it.

| Item | What to hand over |
|---|---|
| Authorization boundary | Diagram and component list |
| Public interfaces | Hosts, API base URLs, admin consoles |
| Accounts | Test accounts per role and customer tenant |
| Third parties | Providers inside and outside the boundary |
| Windows | Dates, hours, change freeze |
| Stop rules | Contacts who can pause the test |

Our [rules of engagement guide](/guides/penetration-testing-rules-of-engagement/) has a clause-by-clause outline.

## What does the 3PAO report, and what do you fix first?

The 3PAO reports results in its security assessment package. As reported, 3PAOs must not include passwords in the final report. Expect findings with severity and evidence, and expect to fix and retest the serious ones before authorization.

Fix in this order: flaws that expose another tenant's data, authentication and session flaws, then injection and misconfiguration. See [after the pentest: remediation and retest](/guides/after-the-pentest-remediation-and-retest/).

## How does a pre-assessment web and API pentest help?

It shortens the fix cycle. Most web and API flaws, such as broken authorization, are found by a human or AI-assisted tester with two accounts. Finding them before the 3PAO means the official report is shorter and the retest list is smaller.

For a pre-test we write a scope with you, test with your written authorization, check the evidence for each finding and write the report. We retest fixed findings on request. We cannot say how it will be received by an assessor.

## Checklist for the 90 days before the assessment

- [ ] Confirm the governing FedRAMP document with your 3PAO
- [ ] Freeze the authorization boundary diagram
- [ ] Run a pre-assessment pentest and fix serious findings
- [ ] Retest the fixes and keep the evidence
- [ ] Create test accounts for each role and tenant
- [ ] Name contacts who can stop the test
- [ ] Agree the rules of engagement with the 3PAO and the authorizing official
- [ ] Plan a change freeze for the 3PAO window

For test frequency in general, see [how often should you pentest](/guides/how-often-should-you-pentest/). For another framework with a written requirement, see [PCI DSS penetration testing requirements](/guides/pci-dss-penetration-testing-requirements/).

## Questions

### Can our own security team run the FedRAMP pentest?

Under the v3 guidance as reported, all penetration test activities must be performed by a 3PAO. The 2026 rules list CA-08 enhancements for independent testing. Read the current FedRAMP page for your impact class, and ask your 3PAO.

### Can Excession Labs provide a FedRAMP penetration test?

No. Excession Labs is a security lab, not a FedRAMP 3PAO. We can test your web app and API before the assessment so you fix flaws earlier. That test does not replace the 3PAO test, and we do not claim any assessor will accept our report.

### How often is a FedRAMP pentest repeated?

The v3 guidance, as reported, asks for a first test no more than six months before the security assessment report and later tests at least every 12 months. The 2026 rules ask Class B, C and D providers for an independent assessment at least once per year. Confirm for your class.

### Is the v3 guidance still the right document?

We could not confirm this on 9 November 2026. FedRAMP restructured its site in 2026, and a draft v4.0 from 2024 has no confirmed final version. Ask your 3PAO and your FedRAMP contact which text governs your authorization.

## Sources

- [FedRAMP Penetration Test Guidance, Version 3 (PDF)](https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf)
- [FedRAMP Rev5 Control Guidance, CA-08](https://www.fedramp.gov/2026/reference/rev5-control-guidance/)
- [FedRAMP: Independent Verification and Validation](https://www.fedramp.gov/2026/reference/independent-verification-and-validation/)
- [NIST SP 800-115: Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)
- [FedRAMP Penetration Test Guidance v4.0 DRAFT (public comment)](https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance_public_comment.pdf)