BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CA-02(03) Leveraging Results from External Organizations

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded CA part of CA-2

Title

Leveraging Results from External Organizations

Control

Leverage the results of control assessments performed by [Assignment: external organization(s)] on [Assignment: system] when the assessment meets [Assignment: requirements].

Discussion

Organizations may rely on control assessments of organizational systems by other (external) organizations. Using such assessments and reusing existing assessment evidence can decrease the time and resources required for assessments by limiting the independent assessment activities that organizations need to perform. The factors that organizations consider in determining whether to accept assessment results from external organizations can vary. Such factors include the organization’s past experience with the organization that conducted the assessment, the reputation of the assessment organization, the level of detail of supporting assessment evidence provided, and mandates imposed by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Accredited testing laboratories that support the Common Criteria Program [ISO 15408-1](#6afc1b04-c9d6-4023-adbc-f8fbe33a3c73) , the NIST Cryptographic Module Validation Program (CMVP), or the NIST Cryptographic Algorithm Validation Program (CAVP) can provide independent assessment results that organizations can leverage.

Parameters

ca-02.03_odp.01: external organization(s)
ca-02.03_odp.02: system
ca-02.03_odp.03: requirements

Related controls

sa-4

Assessment objective

CA-02(03) the results of control assessments performed by [Assignment: external organization(s)] on [Assignment: system] are leveraged when the assessment meets [Assignment: requirements].

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).