Start with the outcome you need to test

A useful red team scope begins with a business question: could unauthorized access to a particular system interrupt operations or expose sensitive information, and would the organization detect and contain it? A list of control identifiers becomes useful only when it helps answer that question.

NIST SP 800-53 Rev. 5 includes penetration testing in CA-8 and red team exercises in CA-8(2). CA-8 leaves testing frequency and the systems to test to the organization. It does not prescribe annual or quarterly red teaming for every organization. The selected controls, organizational requirements, threat model, and changes to the environment determine the engagement.

Treat the six families below as possible starting points for technical exercises, not a universal ranking. Physical access, communications protection, supply chain dependencies, and other families can be central to a different scenario.

Reference: NIST SP 800-53 Rev. 5 — CA-8 and CA-8(2)

Turn control references into test questions

The following are suggested scoping questions. Their relevance depends on the selected controls and the systems covered by the engagement. They are not claims about findings from a client environment.

  • Access Control (AC): For AC-2 account management and AC-6 least privilege, which approved test identities should be unable to reach the protected resource? Include service identities and the access left behind when roles change.
  • Identification and Authentication (IA): Use IA-2 for organizational users and IA-5 for authenticator management. Examine the intended authentication paths and approved exceptions. IA-8 concerns non-organizational users; it is not the general control for all authentication.
  • System and Information Integrity (SI): With SI-3 malicious code protection and SI-4 system monitoring in view, agree safe simulations and the telemetry expected from them. Separate prevention outcomes from detection and response outcomes.
  • Configuration Management (CM): Use CM-6 configuration settings and CM-7 least functionality to select the baselines and unnecessary services worth checking. Record the exact tested configuration so later changes do not invalidate the comparison silently.
  • Audit and Accountability (AU): For AU-2 event logging and AU-6 audit record review, analysis, and reporting, identify which events should be available to defenders. Distinguish a missing event from an event that was recorded but never reviewed.
  • Incident Response (IR): Connect IR-3 incident response testing to the agreed exercise objective. Define who receives an escalation, who can authorize containment, and how the team records its decisions.

Reference: NIST SP 800-53 Rev. 5 control catalog

Keep the assessment and exercise evidence connected

Formal control assessment is broader than checking documentation. NIST SP 800-53A uses examination, interview, and testing methods. A red team exercise can contribute evidence to that work; it does not automatically assess every selected control or replace the assessment plan.

Before testing, agree authorization, boundaries, starting access, excluded actions, stop conditions, and evidence handling. For each scenario, record the objective, the observed result, the systems reached, and the relevant control implementation. Avoid describing an entire family as failed because one implementation had a weakness.

A quiet monitoring console is a finding to investigate. It may reflect missing telemetry, an alerting gap, limited exercise coverage, or an agreed testing restriction. Correlate the activity timeline with defender evidence before drawing the conclusion.

Reference: NIST SP 800-53A Rev. 5 — assessment methods

Make the next decision clear

The report should help an owner choose a corrective action and a reviewer understand the evidence. State what was demonstrated, what remained untested, and what retest would establish that the correction works. A successful exercise provides bounded evidence about the scenarios tested; it cannot prove that every attack path is closed.

Bring the systems you need to protect and the decisions you need to make to the scoping conversation. Those details are more useful than choosing six control families simply because they appear on a checklist.