Relevant Control Families for Penetration Testing:

**CA (Assessment, Authorization, and Monitoring):** CA-8 specifically requires penetration testing - **RA (Risk Assessment):** RA-5 requires vulnerability scanning; RA-3 requires risk assessment - **SI (System and Information Integrity):** SI-2 requires flaw remediation