CA-1 Policy and procedures
Assessment, authorization, and monitoring policy and procedures: documenting, distributing, owning and periodically reviewing the policy and procedures behind control assessment, authorization and continuous monitoring.
CA Assessment, authorization, and monitoring
Assessment, authorization, and monitoring (CA) family of NIST SP 800-53 Rev. 5: control assessments, information exchange agreements, plans of action and milestones, authorization to operate, continuous monitoring and penetration testing.
CA-2 Control assessments
Control assessments: selecting assessors, writing and approving an assessment plan, assessing controls at a defined frequency, producing an assessment report and sharing results, plus independent assessor and specialized assessment enhancements.
CA-3 Information exchange
Approving and managing information exchanges between systems through interconnection, exchange or other agreements that document interfaces, requirements, responsibilities and impact level, with periodic review.
CA-5 Plan of action and milestones
The plan of action and milestones (POA&M): documenting planned remediation of weaknesses and deficiencies found in assessments and known vulnerabilities, and updating it from assessments, audits and continuous monitoring.
CA-6 Authorization
Authorization: assigning senior officials as authorizing officials for the system and for common controls, authorizing operation before it starts, accepting inherited controls and updating authorizations, plus joint authorization enhancements.
CA-7 Continuous monitoring
Continuous monitoring at the system level: metrics, monitoring and assessment frequencies, ongoing assessments, correlation and analysis, response actions and status reporting, plus the risk monitoring enhancement selected in every SP 800-53B baseline.
CA-8 Penetration testing
Penetration testing of defined systems or components at a defined frequency, selected only in the high baseline, plus enhancements for independent testers, red team exercises and facility testing.
CA-9 Internal system connections
Internal system connections between components of the same system, such as mobile devices, printers and sensors: authorizing and documenting each connection, terminating them under defined conditions and reviewing the need for them.
