BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CA-02(02) Specialized Assessments

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded CA High baseline part of CA-2

Title

Specialized Assessments

Control

Include as part of control assessments, [Assignment: specialized assessment frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; {{ insert: param, ca-02.02_odp.04 }} ].

Discussion

Organizations can conduct specialized assessments, including verification and validation, system monitoring, insider threat assessments, malicious user testing, and other forms of testing. These assessments can improve readiness by exercising organizational capabilities and indicating current levels of performance as a means of focusing actions to improve security and privacy. Organizations conduct specialized assessments in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Authorizing officials approve the assessment methods in coordination with the organizational risk executive function. Organizations can include vulnerabilities uncovered during assessments into vulnerability remediation processes. Specialized assessments can also be conducted early in the system development life cycle (e.g., during initial design, development, and unit testing).

Parameters

ca-02.02_odp.01: specialized assessment frequency
ca-02.02_odp.02: [announced; unannounced]
ca-02.02_odp.03: [in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; {{ insert: param, ca-02.02_odp.04 }} ]
ca-02.02_odp.04: other forms of assessment

Related controls

pe-3, si-2

Assessment objective

CA-02(02) [Assignment: specialized assessment frequency] [Selection: announced; unannounced] [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; {{ insert: param, ca-02.02_odp.04 }} ] are included as part of control assessments.

STIG rules that implement this control 1

Application Security and Development V6R5