CA-9 Internal system connections: requirements and evidence

What CA-9 internal system connections requires in SP 800-53

An assessor testing CA-9 will ask for one thing first: a list of every internal connection between components of the same system, and proof that each one was authorized before it was used. CA-9 asks the organization to authorize these internal connections of defined system components, document each connection's interface characteristics, security and privacy requirements and the information it communicates, terminate connections when defined conditions are met, and review whether each connection is still needed at a defined frequency. The control is about links inside your own boundary, such as a laptop syncing to a file server, a networked printer receiving print jobs, a mobile device reaching an internal application, or a sensor pushing readings to a collector. Each of these is a path that can carry data or enable lateral movement, and none of them is covered by a perimeter firewall rule written for external traffic.

The difficulty is almost always inventory. Organizations usually know their servers and their formal interfaces, but not the device-to-device traffic that appears when printers, phones, badge readers or building sensors are added without a change record. Connections are also created by applications and service accounts that a system owner never documented. Before writing any authorization, the practical first step is to reconcile your asset inventory against observed network flows for a representative period, then decide which components are in the system boundary. Confirm with your assessor which inventory sources they will accept as the basis for the list, because a list assembled from memory will not match what the assessor can observe.

Two baseline facts shape the scope. SP 800-53B Release 5.2.0 selects CA-9 in the low, moderate and high baselines, but not in the privacy baseline. Its one enhancement, CA-9(1) on compliance checks, is not selected in any baseline, so a standard assessment does not require it unless your organization adds it through tailoring. Your system security plan should state the connection authorization method, the review frequency and the termination conditions in terms that a named role can execute, and your assessment report should show the authorization decision and the review record for each connection. Ask your assessor to confirm how they will sample connections and which evidence of review they expect.

Which internal connections fall under CA-9 scope

CA-9 applies to connections between components inside one system boundary, so the first job is deciding what counts as a component and where the boundary sits. The cards below cover the device types that usually form these connections, the boundary and authorization questions, and the scoping calls that move work between CA-9 and CA-3.

Endpoints and managed workstations

Laptops, desktops and servers that join the system are the most common internal connections, because they sit on the same network and report into the same management tools. Confirm which endpoints are defined as system components and which belong to a separate system with its own authorization. Inventory data from an asset tool such as GLPI, or from the Wazuh Syscollector module, can show which hosts are actually connected so the authorized list matches the live environment. Each endpoint that talks to the system needs a documented connection, not just a line in an inventory.

Network printers and multifunction devices

Printers and scanners often hold network connections to file shares, email relays and document stores, and they are easy to overlook because they are not managed as computers. Check whether each device is inside the authorization boundary, what information it sends and receives, and whether it is listed as an authorized internal connection. GLPI's Assets module tracks printers and peripherals, which helps build the component list that CA-9 expects an organization to maintain.

IoT sensors and building systems

Sensors, badge readers and environmental monitors may connect to the system through gateways or segmented networks. These devices change often and may run firmware that is hard to patch, so the authorized connection record should state the interface, the data they send and the condition under which the connection ends. Confirm the sensor type, the gateway that carries its traffic and whether a separate interconnection agreement is needed.

Mobile devices and remote clients

Phones and tablets that sync with the system or reach internal applications are internal connections only when they become components of that system. Their scope depends on the mobile management and remote access design, so the authorization should name which device classes connect and under what conditions. Remote access paths are also governed by AC-17 and AC-18, so they should be reviewed together with CA-9 records.

Management and administrative interfaces

Out-of-band management ports, hypervisor consoles, and administrative consoles create connections with high privilege. Because they often bypass normal application paths, they are a frequent gap in connection inventories. Record who may use each interface, the information it carries and how long each session or link is allowed to remain open. Access and configuration controls such as AC-3, AC-19 and CM-2 describe the same paths from different angles.

Boundary controls and the CA-3 decision

The key scoping question is whether a link stays inside the system or crosses into another system. A link to an outside party or another authorized system is generally handled as an information exchange under CA-3, while a link between components of the same system falls under CA-9. Boundary and flow controls such as SC-7, AC-4 and SI-12 show where that line is enforced. Document the decision for each link so the two records do not overlap or leave gaps.

How an assessor tests CA-9 under SP 800-53A

This table maps the SP 800-53A assessment methods for CA-9 to the objects an assessor examines, interviews and tests, the evidence to prepare, and the findings that commonly appear. Read each row as a question the assessor will ask and the artifact that answers it. SP 800-53A assesses CA-9 with 7 determination statements, so the evidence must cover authorization, documentation, termination and review together.

Assessment method	Assessment objects	Evidence to prepare	Common findings
Examine	List of components or classes of components authorized as internal system connections	Dated authorization list of internal connections, with each component or component class and its approving official	Authorized list does not match the live inventory, so some connected devices have no recorded authorization
Examine	Assessment report and system audit records	Prior assessment results covering CA-9, plus audit records showing when connections were established and changed	Earlier assessment findings on CA-9 are not tracked to closure in the plan of action and milestones
Interview	Organizational personnel who develop, implement or authorize internal system connections	Named roles with written responsibilities, and staff able to explain how a new sensor or printer is approved	Staff describe informal approval by email, and no one can name the authorizing official for a connection class
Test	Mechanisms supporting internal system connections	Configuration exports or screenshots from network and access controls showing that only authorized connections are permitted	Connections work that the authorized list does not show, such as an unapproved device reaching a server segment
Examine	Documented interface characteristics, requirements and information communicated for each connection	Connection records listing the interface, protocol, data type and requirement for each authorized connection	Records describe devices but not the data each connection carries, so the reviewer cannot judge necessity
Examine	Defined termination conditions and the review frequency set by the organization	Written termination triggers (for example, decommissioning or role change) and a dated record of the most recent need review	No termination conditions are defined, or the review was scheduled but not performed
Test	Connection termination and removal of access after a defined condition	Sample of a decommissioned device showing the connection was removed and no longer appears in the authorized list	Retired devices remain in the authorized list or still reach internal services

How to implement CA-9 step by step

This sequence takes an organization from no formal rule for internal system connections to a documented, authorized list of connections that is reviewed on a schedule. Each step produces an artifact an assessor can examine against the CA-9 determination statements.

Assign owners and define the authorization process
Name the official who authorizes internal system connections, the system owner who requests them and the team that maintains the inventory of them. Write a short procedure that states how a request is raised, who reviews it and what evidence the approver needs before signing off. Output: an approved procedure with named roles, stored with the system security and privacy plan. The step is done when every role has an accountable person and the procedure has been approved by the authorizing side of the organization.
Build the authorized list of component classes
Identify which classes of components inside the system boundary may connect to each other, such as workstations to file servers, printers to a print service, mobile devices to a mail gateway or sensors to a data collector. Describe each class by type, function and owner, and mark which classes are not permitted to connect internally. Output: an authorized component class list approved by the authorizing official. Confirm the list against the system's current asset inventory so that no connected component falls outside a documented class.
Inventory the components and their connections
Collect the current component inventory from the asset management and endpoint tools in use, then map which components talk to which others over the internal network. Self-hosted tools such as GLPI can hold the asset records, while Wazuh's Syscollector can report hardware, network interfaces, open ports and services from each endpoint. Output: a connection map that lists each internal connection, its two endpoints and the component class of each. Reconcile the map with the authorized list and flag any connection without an authorized class.
Document each connection's interface and information
For every authorized connection, record the interface or protocol used, the ports or services involved, the security requirements that apply, and the categories of information communicated. Store these records in a connection register that the system owner maintains and the assessor can read. Output: one register entry per connection with interface characteristics, requirements and information communicated. The step is complete when no connection in the map lacks an entry and each entry names an owner.
Set termination conditions and review frequency
Define the conditions under which each class of internal connection must be terminated, such as decommissioning of a component, end of a project, a change in data sensitivity or a failed compliance check. Set the review frequency in the organization's own control parameters, since NIST leaves those values to the organization. Output: a written termination rule set and a review schedule approved by the authorizing official. Confirm that the frequency value appears in the system security and privacy plan so that the assessor can compare practice with the stated parameter.
Configure enforcement and monitoring of connections
Apply the authorized list at the network layer so that undocumented internal connections are blocked or alerted. OPNsense with Suricata can produce EVE JSON alerts for matching traffic, and that output can be forwarded to a log management tool for review. Confirm with the platform vendor which enforcement and logging features your version provides before relying on them. Output: documented rules, alert routes and a test record showing that an unauthorized connection is detected. The step is done when a test connection generates the expected alert.
Run the first review and record the results
Perform the first review of every connection in the register against the authorized list, the termination rules and the current business need. Mark each connection as continued, modified or terminated, and record the reviewer, the date and the reason for each decision. Output: a signed review record and an updated register, with terminated connections removed and any gaps logged in the plan of action and milestones. The step closes when the review record is filed with the system documentation for the next assessment.

Which evidence shows CA-9 is met and stays current

CA-9 is satisfied by a set of records that agree with each other: the authorized connection list, the per-connection documentation, the termination and review decisions, and audit data showing connections actually in operation. An assessor tests whether these artifacts exist, match the live environment and were refreshed on the schedule the organization defined. The cards below cover each artifact and how to keep it current between assessments.

Authorized internal connection list

This is the register of which components of the system are permitted to connect to each other, such as workstations, mobile devices, printers and sensors. Each entry should name both endpoints, the authorizing official and the date of authorization. An assessor will compare this list against the connections seen in monitoring data, so any connection missing from the register is a finding. Ask who owns updates when a new device class is onboarded.

Asset inventory as the source of truth

An asset inventory supplies the component identities that the connection list refers to. Hardware, peripherals, network equipment and phones should be recorded with owner, location and status so that every endpoint in a connection entry can be traced to a real asset. GLPI's Assets module can hold this data, entered manually or pushed by its agent. Confirm the inventory is reconciled against discovered devices before each review cycle.

Per-connection interface and information records

For each authorized connection, keep a record of the interface characteristics, the protocols and ports used, the data communicated and the security requirements that apply. These records show the assessor what each connection is for and whether its information flow matches its stated purpose. Update the record whenever the interface changes, and check that it matches the system security plan.

Termination and review decisions

Record the defined conditions under which each connection is terminated, the date it was terminated, and the reason. Keep the review record showing that the continued need for each connection was examined at the frequency the organization defined in its own policy. Ask the organization to name that frequency in writing, since the control leaves it as a parameter to set. Missing review entries are a common assessment gap.

Connection activity from audit records

Audit and network telemetry show whether connections are active and whether they remain within their authorized endpoints. Wazuh Syscollector records network interfaces, open ports and running services from each endpoint, which helps confirm that the connected components match the register. Suricata's EVE JSON output can record flows and protocol transactions for review. Check that these logs are retained long enough to cover the review window.

Exceptions and unauthorized connection alerts

Unauthorized or unexpected internal connections should produce a tracked exception or an alert with a documented response. OPNsense's intrusion detection can alert on or block matching traffic and send alerts to syslog in EVE JSON format. Each alert should be triaged, resolved, or added to the register with a new authorization. Ask the organization how many days a new connection can exist before it must be authorized, and record that answer in its procedures.

Which self-hosted tools produce CA-9 evidence

The authorized list required by CA-9 is most naturally held in an asset inventory, where each component of the system is recorded with its owner, location and role. GLPI (GPL-3.0-or-later) can serve this purpose. Its Assets module manages computers, monitors, software, network equipment, peripherals, printers, phones and racks, and entries can be typed in manually or pushed automatically by the GLPI Agent through the native inventory built into GLPI since version 10. Records for mobile devices, printers and sensors are the ones most often missing from inventories, so the reader should check that each device class in scope has a place in GLPI before relying on it.

Authorized component records: Create asset entries for each internal component, with the owner, location and the system it belongs to, so the list can be exported for an assessor.
Agent-based population: Use the GLPI Agent on managed computers to keep hardware and software records current without manual entry.
Manual entries for unmanaged devices: Printers, sensors and other devices that cannot run an agent need hand-maintained records with a named responsible person.
Change history: Record additions and removals with dates so the list can show when each connection was authorized or terminated.
Review evidence: Keep dated exports of the inventory as proof of the periodic review of connection need.

Before relying on GLPI, confirm with your own environment which device types its inventory covers and whether the license terms suit your distribution model.

What meeting CA-9 costs in money and effort

This table breaks down the cost components of authorizing and documenting internal system connections under CA-9, showing who is paid, whether each item is one-time or recurring, and what drives it up. Use it to shape the questions you put to any implementation partner or assessor before you agree a written scope.

Cost component	One-time or recurring	What drives it and what to ask for in a quote
Tooling and licenses	Recurring if a commercial product is chosen	Open-source inventory tools such as GLPI and Wazuh remove license spend, but hosting, storage and support still apply. Ask which components the quote includes and what it excludes.
Setup and integration of inventory sources	One-time	Driven by how many device types and network segments need discovery. Ask for a list of connection sources to be onboarded and how each one is validated.
Engineering time for connection inventory and documentation	One-time, then periodic updates	Driven by the number of internal connections, such as mobile devices, printers and sensors, and by how documentation is structured. Ask for the expected number of documented connections and the fields recorded for each.
Evidence upkeep and review cycles	Recurring	Driven by how often the organization reviews the continued need for each connection and how often devices change. Ask who maintains the connection register and how changes are reconciled.
Connection termination and monitoring	Recurring	Requires alerting and log retention so that connections beyond defined conditions are noticed. Ask how terminations are recorded and which logs support them.
External review or testing	Periodic, per engagement	Optional independent checks of connection documentation or network segmentation. Ask whether testing is included and how findings are reported back.
Auditor sampling and assessor time	Per assessment cycle	Assessors select samples of connections and examine records. Driven by the number of systems in scope. Ask the assessor how sampling is planned, and treat their fees as separate from any implementation partner work.

Where CA-9 programs usually fall short

CA-9 looks simple on paper: authorize each internal connection, document it, end it when it is no longer needed and review it. Most gaps appear in the day-to-day upkeep of that list, where devices arrive without approval, approvals outlive their purpose and records omit what actually crosses the link. The cards below pair each gap with the action that closes it.

Shadow devices off the list

Mobile devices, printers and sensors join internal segments without anyone adding them to the authorized connection list. The gap is usually found only when an assessor compares network discovery results with the documented list. Reconcile the authorized list against discovered assets on a schedule, and treat any unlisted component as an open finding until it is authorized or removed. Inventory tools such as GLPI can hold the list, but someone must decide what gets added.

Approvals that never expire

A connection authorized during a project often remains in place after the project ends. CA-9 asks the organization to review the continued need for each connection at a defined frequency, and that review is where stale entries surface. Set the review frequency in the system security plan, assign an owner for each connection, and record the outcome of every review so the decision to keep a link is traceable.

Termination conditions left undefined

Many organizations authorize a connection but never write down when it must end. Without defined conditions, a sensor link or service path can persist through a decommissioning, a change of owner or a security incident. Define the termination triggers for each connection class, such as project close, component retirement or a failed review, and confirm that the change process removes the connection when a trigger occurs.

Documentation missing the information communicated

Connection records often list the endpoints but not the interface characteristics, requirements or the information that crosses the link. An assessor testing CA-9 expects each record to describe what the connection carries and why. For each connection, document the protocols, ports, data classes and security requirements, then compare that record with traffic observed in network logs or Suricata EVE JSON output, which can show protocols such as DNS, TLS and SMB.

Inventory and connection records drifting apart

The component inventory and the connection register are often maintained by different teams, so a new device can appear in one and not the other. Systems such as Wazuh Syscollector collect hardware, network interfaces and open ports from each endpoint, which gives a technical baseline to compare against the register. Assign one owner for both records and reconcile them whenever a change ticket closes.

Who owns CA-9, who prepares it and who assesses it

Your organization owns CA-9. Someone accountable for the system must decide which internal connections are authorized, accept the risk of each one, define the conditions under which a connection is terminated, and set the frequency for reviewing whether each connection is still needed. These decisions cannot be delegated to a partner or an assessor, because they are the operating decisions the control exists to record.

Authorization decisions: Approve or reject each internal connection between components of the system, such as a printer, mobile device or sensor, and record who approved it and when.
Termination conditions: Define the events that end a connection, such as a device leaving the network, a project closing or a period of inactivity.
Review frequency: Set how often connections are re-examined for continued need and assign the owner who performs the review.
Documented interface and information scope: Confirm which information each connection carries and which interface characteristics apply before approval.
Records of decisions: Keep the approval, review and termination records in a form that an assessor can examine.

Check that your named authorizing role has written authority over each connection class and that review dates appear in your system security and privacy plan.

CA-9 questions buyers ask before hiring help

What drives the cost of meeting CA-9 internal system connections?

The main cost driver is how many internal connections exist and how many need documented interface details, information descriptions and periodic review. Costs have two parts: internal staff time to build the connection inventory and approval records, and any outside help you buy to prepare that material. Recurring cost comes from the review cycle, since each connection must be re-checked at the frequency you define and after changes. Ask any partner for a fixed-scope quote that lists the systems covered, the number of connections, the documents to be produced and the review cycles included. NIST does not publish cost estimates for SP 800-53 compliance, so use your own inventory size to judge quotes.

How long does CA-9 work take and what sets the timeline?

The timeline depends on how well your component inventory is already known, how many connections must be authorized, and how quickly owners can approve them. NIST does not set a federal implementation timeline for SP 800-53; that timing is left to OMB Circular A-130 and to the agency or contract requiring the control. Teams with a current asset list and clear system boundaries usually move faster than teams that must first discover devices such as printers, sensors and mobile devices. Confirm with any partner which phases are included, who approves each connection, and what dates depend on your side of the work.

What does the work require from our team?

CA-9 work needs named people who own the system, the connected components and the decision to authorize each connection. SP 800-53A lists the people involved as personnel responsible for developing, implementing or authorizing internal system connections, so those roles must be identified and available. You will also need access to audit records and to the mechanisms that carry each connection, because assessors examine those artifacts. Plan for a few hours of review per connection from the owners and for the security team to keep the record current. Ask a partner to name the decisions they need from you before work starts.

Can we meet CA-9 in-house using open-source tools?

Yes, many teams build the evidence in-house with open-source tooling, but the organization still owns the control and its approvals. GLPI's Assets module can record computers, monitors, software, network equipment, peripherals, printers, phones and racks, entered manually or pushed by the GLPI Agent, which gives you a starting component list. Wazuh's Syscollector collects hardware, network interfaces, open ports, services and users from each endpoint, which helps confirm what is actually connected. OPNsense's intrusion detection, which runs Suricata, can send EVE JSON alerts to syslog, and Suricata's EVE output can split records into separate files for log tools. Confirm with each vendor that these tools cover your specific device types before relying on them.

Can a partner replace the independent assessor for CA-9?

No. A partner can prepare the connection inventory, documentation, approvals and evidence, but only an independent assessor can test the control and report on it. In SP 800-53, the assessment is the job of the assessor using the procedures in SP 800-53A, which include examining records, interviewing personnel and testing mechanisms. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. Your contract or authorizing official determines who must perform the assessment, so confirm that requirement before you select a partner.

Does CA-9 apply to the privacy baseline or only security baselines?

CA-9 is selected in the low, moderate and high security control baselines but not in the privacy baseline. This means a system categorized at any of those three impact levels needs CA-9 implemented and assessed, while a privacy-only scope does not select it by default. Confirm your impact level and the baseline your contract or authorizing official specifies, since tailoring can change what applies. The enhancement CA-9(1), which covers compliance checks, is not selected in any of the four SP 800-53B baselines, so do not budget for it unless your organization adds it through tailoring.

What should we ask a partner to put in writing?

Ask for a written scope that names the systems, the connection types, the documents produced and the assessment-ready evidence delivered. The statement of work should also state who signs off on each connection, what review frequency applies, and what happens when a connection is terminated. Confirm that deliverables are fixed-scope where possible, and ask what recurring support is available after delivery, since ongoing review is a continuing cost. Ask whether the partner will hand over the inventory and records in a form your team can maintain, and confirm that the independent assessor is named separately.

How DeployOpen scopes and prepares CA-9 evidence

DeployOpen works on CA-9 as a fixed-scope piece of implementation work inside your own environment. We help you define which internal connections exist, prepare the systems that record them, and package the documentation an independent assessor will ask to see, while your organization keeps ownership of the authorization decisions.

How we scope

Agree in writing which system boundary, component classes and internal connections fall under CA-9.
Confirm the defined conditions for terminating connections and the review frequency your organization has chosen.
Identify the personnel who authorize internal connections so interview evidence has a named owner.

How we build

Configure self-hosted inventory tooling so mobile devices, printers and sensors are recorded with their connection details.
Set up monitoring that captures connection and traffic records for the components in scope.
Test that inventory and log records are complete and that stale connections surface for review.

How we hand over

Deliver connection records covering interface characteristics, requirements and the information each connection carries.
Provide documented termination criteria, review schedules and the audit records that show each review took place.
Hand over runbooks so your team can keep the authorization list current after the engagement ends.

How we support

Offer ongoing support and upgrades as a retainer for the inventory and monitoring platforms.
Provide periodic review of connection records against the authorized list, scoped in writing.
Confirm with your independent assessor which evidence formats they accept before final delivery.