← CIS Controls v8 in plain English

18.2 IG2

Control 18 / Penetration Testing

Perform Periodic External Penetration Tests

Think of it likeA stranger with no floor plan is paid to probe the outside of the house, testing only what an actual burglar on the street could reach.

In plain English

From outside the network, testers attack the systems exposed to the internet to see what a real remote attacker could break through.

Related CSF subcategories (unofficial mapping)

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.