Testing Evidence That Holds Up: A Vulnerability Assessment Roadmap for Program Offices

A program office buys a vulnerability assessment to answer someone else's question. The assessor needs tested evidence for the Security Assessment Report. The Authorizing Official needs to know what risk is left. The Inspector General wants proof that vulnerability management works. And for civilian agencies, CISA now wants each finding fixed on a clock set by how dangerous it really is.

Raw scanner output answers none of those questions well. This roadmap is for the program manager, ISSM or ISSO who has to scope a test so its results hold up in all four places.

What Testing Supports, Control by Control

The NIST SP 800-53 Rev. 5 controls below are the ones a validated assessment evidences most directly.

CA-8 is required at the High baseline and is often tailored into Moderate. Under NIST SP 800-37 Rev. 2 (opens in a new tab), testing feeds the Assess step that precedes every authorization, and FISMA's periodic independent assessment draws on the same evidence.

Defense contractors use the same work differently. Under NIST SP 800-171, testing supports requirements 3.11.2 (vulnerability scanning), 3.12.1 and 3.12.3 (assessing and monitoring controls), and 3.14.1 (flaw remediation) in a self-assessment. Penetration testing is not itself a CMMC practice, so it should be presented as evidence, not as a requirement met. DoD suspended Phase 2 third-party certification on July 13, 2026 (opens in a new tab) while a review runs, but Phase 1 self-assessment and the underlying 800-171 obligations remain.

The BOD 26-04 Deadlines

For Federal Civilian Executive Branch agencies, BOD 26-04 (opens in a new tab), issued June 10, 2026, replaced BOD 22-01 and BOD 19-02. It sets remediation clocks from four inputs: public exposure, presence in the Known Exploited Vulnerabilities catalog, automatable exploitation and technical impact. The clocks range from three days, with forensic triage for KEV-listed flaws that yield total control, to 14 days, 60 days, or the next system upgrade.

The compliance timeline matters for planning. Agencies had to update policy immediately, update processes within 60 days, and meet the full remediation timelines within about 180 days, which lands around December 2026. A program office that plans testing now can put its findings on the right clocks before the full timelines apply.

Validated testing helps directly with two of the four inputs. Whether an asset is really reachable from outside, and whether a flaw is exploitable as configured, are facts about the agency's environment that a scanner can only guess at.

What Stays With the Government, and With Others

Four decisions do not belong to the testing firm, and the roadmap should say so in writing:

1. The authorization. The Authorizing Official decides whether residual risk is acceptable. Testing informs the decision; it does not make it.
2. The independent assessment. Where the assessor must be independent of the team that prepared the package, the tester's report is input to that assessor, not a substitute.
3. FedRAMP's annual test. Under the 2026 rules, a cloud provider's annual penetration test must come from a FedRAMP Recognized independent assessment service (opens in a new tab). An outside firm can only run readiness testing before it.
4. CMMC certification. That belongs to a C3PAO, once third-party assessment resumes.

Approved language keeps a proposal or status brief honest: the assessment "produces tested, evidence-backed findings and a prioritized remediation plan that support" the assessment, authorization or self-assessment. It does not "certify," "achieve compliance" or "guarantee" an outcome.

Terms That Keep the Evidence Usable

Testing evidence is only as good as the agreement behind it. The rules of engagement and SOW should include:

• Named scope. Address ranges, applications, cloud accounts and environments, with exclusions listed. Additions only by written change order.
• Defined depth. Validation only, lateral movement, or red team, stated before testing starts.
• Independence statement. Confirmation that the testers are independent of the system's operators and developers, which supports CA-8(1).
• Agency obligations with dates. Test accounts, the testing path, allow-listing and documentation, each with an owner. Late credentials are the most common cause of slippage.
• Evidence handling. How screenshots, logs and artifacts are stored, who may see them, and when they are destroyed, including any CUI touched as proof.
• Deliverables in assessment form. Findings mapped to controls, a remediation roadmap ranked by risk and remediation clock, an executive summary and a retest option.
• Firm fixed price by scope tier. The scope and deliverables are definable, so the pricing should be too.

Making the Findings Usable Downstream

Findings feed three records the program office already keeps. Each confirmed finding should become a POA&M item with an owner, resources and a scheduled completion date, which is what an AO reads first. The test report and evidence package go into the authorization record as CA-8 and CA-2 evidence. And the retest memo closes the loop for SI-2 and CA-7. Findings the agency decides not to fix need a documented risk acceptance from the AO, not silence.

Packages built on evidence an assessor can verify (opens in a new tab) move faster through assessment, and testing evidence is part of that. It should be organized in the governance platform by control, with dates and sources in the artifact names, rather than attached as one large PDF.

Choosing Between CISA and an Outside Test

Civilian agencies can request risk and vulnerability assessments from CISA at no cost, and a program office should consider that option first. The trade-off is schedule. CISA's capacity is finite, and its calendar may not match an assessment date, a reauthorization or a remediation deadline.

An outside engagement makes sense when the date is fixed and cannot move, when the scope is narrow and specific to one system, or when the program needs a retest on its own timeline. Either way, the evidence requirements above are the same, so the roadmap does not change with the provider.

Timing the Test

Testing has the most value when it lands before a decision that depends on it. Common anchors are:

• the RMF Assess step for a new system or a significant change;
• an ATO reauthorization, where the test should finish early enough to fix and retest findings before the package goes to the AO;
• the agency's FISMA annual assessment cycle;
• the BOD 26-04 full-compliance date for civilian agencies;
• year-end O&M funds, since most single-system tests fit under the simplified acquisition threshold.

For a system with an ATO expiring in the next year, the reauthorization timeline (opens in a new tab) usually decides when the test has to be on contract.

Avalon's Vulnerability Assessment & Exploitation service is the execution layer for this roadmap. Under a signed ROE, it produces validated findings mapped to CA-8, RA-5 and the other controls above, a remediation roadmap ranked by real risk and the applicable BOD 26-04 clock, and the retest evidence that closes each finding in your authorization record.