NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| CA-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy | |
| CA-02 | Control Assessments | a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls and control enhancements under assessme | |
| CA-02(01) in CA-2 |
Independent Assessors | Employ independent assessors or assessment teams to conduct control assessments. | |
| CA-02(02) in CA-2 |
Specialized Assessments | Include as part of control assessments, [Assignment: specialized assessment frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerabili | |
| CA-02(03) in CA-2 |
Leveraging Results from External Organizations | Leverage the results of control assessments performed by [Assignment: external organization(s)] on [Assignment: system] when the assessment meets [Assignment: requirements]. | |
| CA-03 | Information Exchange | a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; s | |
| CA-03(01) in CA-3 |
Unclassified National Security System Connections withdrawn | ||
| CA-03(02) in CA-3 |
Classified National Security System Connections withdrawn | ||
| CA-03(03) in CA-3 |
Unclassified Non-national Security System Connections withdrawn | ||
| CA-03(04) in CA-3 |
Connections to Public Networks withdrawn | ||
| CA-03(05) in CA-3 |
Restrictions on External System Connections withdrawn | ||
| CA-03(06) in CA-3 |
Transfer Authorizations | Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data. | |
| CA-03(07) in CA-3 |
Transitive Information Exchanges | (a) Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a) ; and (b) Take measures to ensure that transitive (downstream) information exchanges cease when the control | |
| CA-04 | Security Certification withdrawn | ||
| CA-05 | Plan of Action and Milestones | a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vul | |
| CA-05(01) in CA-5 |
Automation Support for Accuracy and Currency | Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: automated mechanisms]. | |
| CA-06 | Authorization | a. Assign a senior official as the authorizing official for the system; b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c. Ensure that the authorizing official | |
| CA-06(01) in CA-6 |
Joint Authorization — Intra-organization | Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization. | |
| CA-06(02) in CA-6 |
Joint Authorization — Inter-organization | Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization. | |
| CA-07 | Continuous Monitoring | Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monit | |
| CA-07(01) in CA-7 |
Independent Assessment | Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. | |
| CA-07(02) in CA-7 |
Types of Assessments withdrawn | ||
| CA-07(03) in CA-7 |
Trend Analyses | Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data. | |
| CA-07(04) in CA-7 |
Risk Monitoring | Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring. | |
| CA-07(05) in CA-7 |
Consistency Analysis | Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined actions]. | |
| CA-07(06) in CA-7 |
Automation Support for Monitoring | Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: automated mechanisms]. | |
| CA-08 | Penetration Testing | Conduct penetration testing [Assignment: frequency] on [Assignment: system(s) or system components]. | |
| CA-08(01) in CA-8 |
Independent Penetration Testing Agent or Team | Employ an independent penetration testing agent or team to perform penetration testing on the system or system components. | |
| CA-08(02) in CA-8 |
Red Team Exercises | Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: red team exercises]. | |
| CA-08(03) in CA-8 |
Facility Penetration Testing | Employ a penetration testing process that includes [Assignment: frequency] [Selection (one or more): announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility. | |
| CA-09 | Internal System Connections | a. Authorize internal connections of [Assignment: system components] to the system; b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; | |
| CA-09(01) in CA-9 |
Compliance Checks | Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection. |
32 of 1196.