NIST 800-115 Penetration Testing: Phases, Techniques and Compliance

Quick answer: NIST 800-115 penetration testing is a penetration test planned and carried out using NIST Special Publication 800-115, the Technical Guide to Information Security Testing and Assessment. The guide describes a four-phase penetration testing process (planning, discovery, attack and reporting) and a wider set of review, discovery and validation techniques that help organizations test security in a structured, repeatable and well-documented way.

Government agencies, contractors and regulated businesses often need to show that their security testing follows a recognized standard. NIST SP 800-115 is one of the most widely cited references for that purpose. It is vendor-neutral, free to use and referenced in guidance for frameworks such as FedRAMP and PCI DSS.

This guide explains what NIST SP 800-115 is, how its penetration testing phases work, which techniques it covers, how it relates to compliance frameworks and how to plan a test that meets its expectations. To run a test aligned with NIST guidance, explore Privaxi's testing and assessment services.

What Is NIST SP 800-115?

NIST SP 800-115 is a technical guide published by the U.S. National Institute of Standards and Technology. It explains how to plan and conduct information security tests and assessments, analyze the findings and develop mitigation strategies. It covers more than penetration testing: it also describes documentation reviews, log reviews, configuration reviews, network discovery, vulnerability scanning, password cracking and social engineering.

The guide is not a checklist of specific vulnerabilities and does not tell you which tools to use. Instead, it gives a framework for organizing testing so that it is planned, safe, consistent and useful. That is why NIST 800-115 penetration testing is often requested when organizations need a defensible, documented methodology rather than an ad hoc test.

What Is NIST 800-115 Penetration Testing?

NIST 800-115 penetration testing is a test in which qualified assessors simulate real attacks against systems, networks or applications while following the planning, execution and reporting practices described in SP 800-115. The test is scoped and authorized in advance, run in defined phases, documented carefully and followed by analysis and remediation recommendations.

In practice, testers combine SP 800-115 with more detailed technical resources. For example, application testing often uses OWASP guidance for specific test cases, while the NIST guide provides the overall structure. Our guide to OWASP penetration testing explains how those application resources fit in.

The Four Phases of NIST 800-115 Penetration Testing

An important feature of the model is the loop between discovery and attack. When testers gain new access during the attack phase, they return to discovery to learn more about the newly reachable systems, then attack again. This mirrors how real attackers move through an environment and is central to effective NIST 800-115 penetration testing.

Phase 1: Planning

Planning sets the foundation. The organization and testers agree on objectives, scope, systems in and out of bounds, testing times, communication paths and how to handle sensitive data. The guide stresses formal written authorization and a clear rules of engagement document so that testing is legal, safe and expected by the right people.

Phase 2: Discovery

Discovery has two parts. First, testers gather information about hosts, services, names and technologies through techniques such as network discovery and port scanning. Second, they analyze that information and compare it against known vulnerabilities, often using vulnerability scanning and manual research.

Phase 3: Attack

In the attack phase, testers try to exploit identified weaknesses to confirm they are real. Successful attacks may lead to further access, privilege escalation or additional system browsing. Each step is carefully controlled to avoid damaging systems or data.

Phase 4: Reporting

Reporting happens throughout the test as well as at the end. Critical issues are communicated promptly, and the final report describes the vulnerabilities found, their risk ratings, evidence and practical guidance for fixing them.

Testing Techniques Covered by NIST SP 800-115

Penetration testing sits in the validation category, but a complete NIST 800-115 penetration testing engagement often uses techniques from all three. Reviews provide context, discovery finds targets and validation proves real-world impact.

Test Perspectives: Internal, External, Overt and Covert

The guide describes testing from different viewpoints. External testing is done from outside the organization's perimeter, simulating an internet-based attacker. Internal testing assumes the attacker is already on the network, such as a malicious insider or a compromised workstation. Overt testing happens with the knowledge of IT staff, which supports collaboration and learning. Covert testing is done without informing most staff, which helps measure how well detection and response work.

Choosing the right mix of perspectives is part of planning a strong NIST 800-115 penetration testing engagement. Many organizations combine external and internal tests, and add covert elements once basic defenses are mature. For network-focused testing, see our guide to network penetration testing.

Rules of Engagement and Safety

NIST SP 800-115 places strong emphasis on planning for safety. A rules of engagement document should describe what may be tested, what techniques are allowed, when testing happens, how sensitive data is handled, who to contact if something goes wrong and how testing can be stopped. It should also confirm that the people approving the test have authority over every system in scope, including those hosted by third parties.

These controls protect both the organization and the testers, and they are a key difference between professional NIST 800-115 penetration testing and uncontrolled scanning.

Post-Testing Activities

The guide does not end at the report. It describes analyzing findings to identify root causes, recommending mitigation actions, prioritizing them by risk and developing a plan to address them. Common root causes include missing patches, weak configuration standards, poor password practices and insufficient monitoring. Fixing root causes, not just individual findings, prevents the same problems from returning. Our guide to penetration testing remediation explains how to organize this work.

NIST 800-115 and Compliance Frameworks

• FedRAMP: penetration testing guidance for cloud service providers draws on NIST methodologies, making SP 800-115 a natural reference.

• NIST SP 800-53: control CA-8 addresses penetration testing for federal systems, and SP 800-115 is commonly used to plan how it is carried out.

• PCI DSS: requires a defined penetration testing methodology based on industry-accepted approaches, and NIST SP 800-115 is frequently cited as one. See PCI DSS 11.4 penetration testing.

• CMMC and defense contractors: organizations protecting controlled unclassified information often use NIST-aligned testing to support their security assessments. See CMMC compliance assessment.

• HIPAA and healthcare: NIST publications are widely used to support HIPAA risk analysis. See HIPAA penetration testing.

Referencing SP 800-115 in your methodology helps auditors and assessors understand how testing was planned and performed.

NIST 800-115 Compared With Other Methodologies

Several respected methodologies exist, and they often complement each other. The Penetration Testing Execution Standard (PTES) provides detailed technical stages. The Open Source Security Testing Methodology Manual (OSSTMM) focuses on measurement and operational security. OWASP resources specialize in web, API and mobile applications. NIST SP 800-115 stands out for its emphasis on planning, authorization, documentation and post-test analysis, which makes it well suited to regulated environments. Many providers build their NIST 800-115 penetration testing approach by combining SP 800-115's structure with technical depth from the others. Our article on penetration testing methodology compares these in more detail.

Who Should Use NIST 800-115 Penetration Testing?

• U.S. federal agencies and their contractors.

• Cloud service providers pursuing FedRAMP authorization.

• Defense industrial base organizations preparing for CMMC assessments.

• Healthcare, financial services and other regulated organizations that need documented methodologies.

• Any organization that wants a structured, defensible approach to security testing.

How to Plan a NIST 800-115 Penetration Test

1. Define objectives. Decide what you want to learn, such as whether an outside attacker can reach sensitive data.

2. Set the scope. List networks, systems, applications and cloud environments in and out of scope.

3. Choose perspectives. Decide on external, internal, overt or covert testing.

4. Write rules of engagement. Document allowed techniques, timing, contacts, data handling and stop conditions.

5. Obtain authorization. Get written approval from system owners and any third-party hosting providers.

6. Prepare the environment. Back up critical systems and notify relevant teams where testing is overt.

7. Run the test. Follow the discovery and attack loop, reporting critical issues promptly.

8. Analyze and fix. Review root causes, plan mitigation and schedule retesting.

Following these steps gives you a NIST 800-115 penetration testing engagement that is safe, well documented and useful for both security and compliance.

What a NIST-Aligned Report Should Contain

• Executive summary of overall risk and key themes.

• Scope, objectives, test perspectives and rules of engagement.

• Methodology description referencing NIST SP 800-115 phases.

• Detailed findings with risk ratings, affected systems and evidence.

• Attack paths showing how weaknesses were chained together.

• Root cause analysis and prioritized mitigation recommendations.

• Retest results confirming which issues were resolved.

Cost of NIST 800-115 Penetration Testing

Following SP 800-115 does not by itself make testing more expensive, but the planning, documentation and reporting it expects do take time. Costs depend mainly on scope size, the number of test perspectives, the complexity of systems and whether retesting and compliance reporting are included. A small external test may take only a few days, while a combined internal, external and covert engagement across several sites can take weeks of tester time. See our guide to penetration testing cost for typical pricing factors.

Common Mistakes to Avoid

• Skipping formal written authorization or leaving third-party hosts out of approvals.

• Treating vulnerability scan results as a completed penetration test.

• Ignoring the discovery and attack loop, which limits how far testers explore.

• Writing reports without root cause analysis or clear mitigation steps.

• Failing to retest after fixes are made.

Avoiding these mistakes ensures NIST 800-115 penetration testing delivers both strong security insight and evidence that stands up to review. For continuous coverage between formal tests, consider Privaxi's AI-assisted penetration testing.

Frequently Asked Questions About NIST 800-115 Penetration Testing

What is NIST 800-115 penetration testing?

NIST 800-115 penetration testing is a penetration test planned and performed using NIST SP 800-115, which defines planning, discovery, attack and reporting phases along with supporting review and discovery techniques.

What are the four phases of NIST 800-115?

The four penetration testing phases are planning, discovery, attack and reporting, with a loop between discovery and attack as testers gain new access.

Is NIST SP 800-115 mandatory?

It is a guideline rather than a law, but many government, defense and regulated organizations use it to meet requirements for documented, industry-accepted testing methodologies.

Does PCI DSS accept NIST 800-115?

PCI DSS requires a penetration testing methodology based on industry-accepted approaches, and NIST SP 800-115 is commonly cited as one.

How is NIST 800-115 different from OWASP?

NIST SP 800-115 provides an overall framework for planning, running and reporting security tests, while OWASP provides detailed technical guidance for testing web, API and mobile applications.

Who should use NIST 800-115 penetration testing?

Federal agencies, contractors, FedRAMP and CMMC candidates, and regulated organizations that need a structured and defensible testing methodology.

Final Thoughts

NIST 800-115 penetration testing gives you a structured, well-documented way to test security: plan carefully, discover and attack in a controlled loop, and report findings with clear guidance for fixing them. Its focus on authorization, safety and post-test analysis makes it a strong choice for government, defense and regulated organizations.

To plan and run NIST 800-115 penetration testing for your environment, explore Privaxi's testing and assessment services.