← CIS Controls v8 in plain English

18.5 IG3

Control 18 / Penetration Testing

Perform Periodic Internal Penetration Tests

Think of it likeTesting your home security from the inside to make sure everything is secure even if someone gets in.

In plain English

Internal penetration tests run regularly to confirm that defenses hold up even against someone already inside.

Related CSF subcategories (unofficial mapping)

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.