Defines the frequency for conducting penetration testing on organization-defined systems or system components.
No STIG checks reference this CCI.