Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components.
No STIG checks reference this CCI.