NIST 800-53 assessment: how it works and who runs it

How is a NIST 800-53 assessment performed, and who does it?

When a contract, agency or FedRAMP requirement asks for an SP 800-53 assessment, the core fact is this: an assessor tests each selected control against the SP 800-53A procedures, and the organization's authorizing official decides what to do with the findings. NIST publishes no cost or timeline estimates for this work, so the scope agreed in writing with your assessor sets both the price and the schedule. Ask for that scope before anyone starts collecting evidence.

The effort differs widely between organizations, and the drivers are mostly known before work begins. The first is the control set itself: a low, moderate or high baseline from SP 800-53B, or a tailored version of it, with every enhancement and parameter that applies. The second is the depth and coverage the authorizing official selects for each assessment method, since these attributes set how rigorous each examine, interview and test step must be. The third is the number of systems in the boundary, and the fourth is how many controls are inherited from common control providers, whose assessment results you must obtain rather than recreate. The last is whether the assessor is independent, because the authorizing official sets the required level of independence based on the system's categorization and risk. Confirm each of these four points with the authorizing official before quoting.

Responsibility is split in a way that matters for procurement. The organization owns its controls and the risk decision. An implementation partner such as DeployOpen can prepare systems, configurations and evidence, but it does not produce assessment results, and it should not act as the independent assessor for the same system. Only the independent assessor's work, documented in the security assessment report, and the authorizing official's process produce the outcome. Nothing in this preparation work guarantees a satisfied finding on any determination statement, so plan for other-than-satisfied results and the plan of action and milestones that follows them.

How an SP 800-53 assessment runs from scope to authorization package

The sequence turns a defined system boundary and control set into an assessment record that the authorizing official can use to make a risk decision. Each phase has a named output, and the organization, its assessor and the authorizing official each own different parts of it.

Confirm the system boundary and control set
The system owner confirms what is inside the authorization boundary, the security categorization and the selected SP 800-53B baseline or tailored control set. Each control and enhancement in scope becomes a line item to assess. The output is a signed boundary description and control list that the assessor and authorizing official both accept. Ask the assessor to confirm in writing that the list matches the system security and privacy plan before any testing is planned, because an assessment against the wrong boundary produces findings that do not apply to the system being authorized.
Agree depth, coverage and assessor independence
The authorizing official sets the required level of assessor independence based on the system's categorization and risk, and agrees the depth and coverage values for each assessment method with the assessor. SP 800-53A defines depth and coverage as basic, focused and comprehensive, so this choice drives how much evidence each procedure requires. The output is a written assessment plan that records the independence level, the depth and coverage per method, and the scope. Confirm the schedule and fees in that written scope before work starts, since the plan sets them.
Prepare evidence for each assessment procedure
The system owner and control owners gather the artifacts each SP 800-53A procedure names, such as policies, plans, configuration baselines, scan results, access reviews, logs and training records. Inherited common controls need the provider's evidence package as well. The output is an evidence index that maps each determination statement to the artifact, its date and its owner. Check that every artifact is current and that the assessor has read access before fieldwork begins, because missing evidence is one of the main reasons a determination ends as other than satisfied.
Run examine, interview and test activities
The assessor works through each procedure, applying the examine method to specifications, mechanisms and activities, the interview method to the people who run them, and the test method where the procedure calls for exercising a mechanism under set conditions. The system owner schedules interviews and test windows and watches for changes that affect results. The output is a set of assessor work papers that record what was examined, who was interviewed, what was tested and what was observed, with the time and version of each item.
Record satisfied and other-than-satisfied findings
For each determination statement, the assessor records a finding of satisfied or other than satisfied. Other than satisfied covers both a control that fails and a control where the assessor could not obtain enough information, so the reason must be stated. The organization may define severity subcategories for these findings. The output is a findings register where every determination statement has exactly one result and a supporting reference. Review the register with the system owner before the report is drafted so factual errors are corrected while the evidence is still available.
Write the security and privacy assessment reports
The assessor writes the security assessment report and the privacy assessment report from the findings register, covering scope, methods, depth, coverage, results and the basis for each finding. The system owner reviews the drafts for accuracy and may respond to findings with additional evidence, which the assessor then evaluates. The output is the final assessment reports, dated and signed by the assessor. Ask the assessor to state which findings were resolved during assessment and which remain open, because that distinction shapes the plan of action and milestones.
Build the plan of action and milestones
The system owner records each open weakness in a plan of action and milestones, with a remediation approach, a responsible owner and planned completion dates set by the organization. Weaknesses are linked to the assessment finding that produced them. The output is a POA&M that matches the findings register one to one for open items. Confirm with the authorizing official how they want risk acceptance recorded, because some weaknesses may need to be accepted rather than fixed before a decision.
Hand the authorization package to the authorizing official
The system owner assembles the authorization package, which SP 800-53A, citing SP 800-37, lists as the security plan, privacy plan, security assessment report, privacy assessment report and plan of action and milestones. The authorizing official reviews it and makes the authorization decision, which the official alone can make. The output is the complete package and the official's written decision. Because the decision and its risk acceptance are the authorizing official's responsibility, outside partners prepare the package but do not sign it as the decision.

What an SP 800-53A assessment procedure checks

An SP 800-53A procedure tells the assessor what to check for one control or enhancement, and it is the document your evidence has to satisfy. Each procedure is built from assessment objectives, and each objective contains one or more determination statements that restate, in testable form, what the control text requires. Alongside those statements, the procedure lists the potential assessment methods (examine, interview and test) and the assessment objects, which are the specifications, mechanisms, activities and individuals the assessor may look at. The assessor works through the determination statements, not the control prose, so the evidence you prepare should map to each statement directly.

The scale of this is large. In the Release 5.2.0 OSCAL catalog, the procedures contain 2,776 determination statements across 1,014 active controls and enhancements. The examine method is specified for 1,013 of those controls and enhancements, interview for 1,012 and test for 906. Almost every item expects a document review, most expect a conversation with a responsible person, and most of the test-method items are where an assessor will want to watch a mechanism behave. Plan your evidence index by method as well as by control, because a policy that satisfies examine does not satisfy a test method on its own. Confirm the exact method and object list for each control in the OSCAL catalog before you schedule interviews or test windows.

Use the same identifiers the assessor uses. CPRT and SP 800-53A labels carry leading zeros, so AC-1 appears as AC-01, and your evidence index should use that form so an assessor can match each artifact to its procedure without translation. The machine-readable source for the procedures is the NIST OSCAL catalog in the usnistgov/oscal-content repository, which lets you generate the index and track which determination statements have no evidence yet. Read the catalog for the controls in your baseline rather than working from a summary, and confirm the release version your assessor is using before you start.

Which examine, interview and test methods an assessor uses

SP 800-53A gives every control an assessment procedure built from determination statements and one or more methods. The three methods examine, interview and test each produce different evidence and draw on different people in your organization, so plan who must be available before the assessor arrives.

Examine: reviewing specifications and activities

An examine procedure has the assessor review, inspect, observe or analyze specifications such as policies, plans and configurations, mechanisms such as firewalls and logging tools, and activities such as access reviews. The evidence is the artifact itself, dated and tied to the system, for example an approved system security plan or an exported configuration. Confirm that documents are current, version-controlled and match what the system actually does, because a stale document is a common reason for an other than satisfied finding. Policy owners and document custodians should be available to explain what each artifact covers.

Interview: discussions with control owners

An interview procedure has the assessor hold discussions with individuals or groups to confirm how a control is understood and carried out day to day. The evidence is the assessor's notes and the consistency of the answers with the documents and test results. Interviews are where gaps between written policy and practice surface, such as an administrator who describes a review step that no record shows. System administrators, security operations staff, HR, and the control owners named in the plan should be available, and they should be briefed on the control's wording so their answers are accurate.

Test: exercising controls under set conditions

A test procedure has the assessor exercise a mechanism or activity under specified conditions and compare actual behavior with expected behavior. Examples include attempting an unauthorized login, triggering an alert, or restoring a backup. The evidence is the test script, timestamps, logs and the observed result. Test activity changes system state, so the organization must own a controlled environment, written approvals, a rollback plan and named operators who can halt the test. Agree on test windows and stop conditions in the rules of engagement before any test begins.

Combining methods within one procedure

Most assessment procedures use more than one method, and the determination statements within a procedure are often met by a combination of examine, interview and test. For example, a control on audit log review may require the assessor to examine the review records, interview the analyst who performs the review, and test that a logged event reaches the review queue. Each determination statement still yields its own satisfied or other than satisfied finding, so an assessor may hold strong documents and weak interviews. Ask your assessor to map which method covers which statement, and prepare evidence for each method, not just the one you find easiest to produce.

How depth and coverage change the assessment effort

This table compares the basic, focused and comprehensive values of the two SP 800-53A attributes, depth and coverage, and shows what each value changes in the assessment. Read each row to see how a setting affects the rigor of the methods, the scope of what gets examined and the evidence the assessor will need. The main takeaway is that the authorizing official and the written assessment plan choose these values, and higher settings usually mean more evidence and more testing.

Attribute and value	What it changes in the assessment	When it fits and what it means for evidence and assessor time
Depth: basic	Methods are applied at a lighter level of rigor, with less detailed review of specifications and mechanisms and fewer tests of how activities behave under specified conditions.	Fits lower assurance needs and systems with lower categorization or risk. Expect a smaller evidence set and less assessor time, but confirm the reduced rigor is acceptable to the authorizing official.
Depth: focused	Methods are applied with more detailed review and testing than basic, focusing on the parts of the control most relevant to the system's risk.	Fits a moderate assurance need and is a common middle setting. Expect more examination artifacts and some hands-on testing, so ask the assessor how the focus areas are chosen and documented.
Depth: comprehensive	Methods are applied with the greatest rigor, including detailed examination of specifications and mechanisms and thorough testing of activities under specified conditions.	Fits the highest assurance needs and systems with higher categorization or risk. Expect the largest evidence volume and the most assessor testing time. Confirm the expected effort in the quote before work starts.
Coverage: basic	The scope of objects and activities examined is limited to a representative or minimal set of components, people and processes.	Fits systems with a narrow boundary or lower risk tolerance for unexamined components. Expect fewer sampled items and fewer interviews, but document why the sample is sufficient.
Coverage: focused	The scope expands to a broader set of assessment objects and activities, selected on the basis of the system's risk and boundary.	Fits a moderate assurance need across a typical boundary. Expect a larger inventory of sampled systems, staff and records, so confirm how samples are selected and how many are included in the plan.
Coverage: comprehensive	The scope covers the full set of assessment objects and activities relevant to each control across the system boundary.	Fits the highest assurance needs and large or complex boundaries. Expect the largest number of items to collect, review and test, which generally raises both evidence volume and assessor time. Ask for the sample and population sizes in writing.

How findings become the authorization package

Each determination statement produces one finding, and that finding is either satisfied (S) or other than satisfied (O). Other than satisfied does not only mean the control failed. Under SP 800-53A, it can also mean the assessor could not obtain enough information to make the determination, for example because an artifact was never produced, a sample was not provided or an interview could not be held. Those two situations call for different responses. A failed control needs remediation and a plan of action and milestones entry, while an evidence gap usually needs the organization to supply the missing material and let the assessor re-test. Organizations may also define severity subcategories for other than satisfied findings, so that the assessment report and the plan of action and milestones can rank them. Agree those subcategories, and the rules for who assigns them, before fieldwork starts so that the same finding is not graded differently across a rerun.

SP 800-53A, citing SP 800-37, says the *authorization package* consists of five documents: the security plan, the privacy plan, the security assessment report, the privacy assessment report and the plan of action and milestones. The organization writes the security and privacy plans, which describe the system, its controls and how each control is implemented. The assessor writes the security and privacy assessment reports, which record what was examined, interviewed and tested and the resulting findings. The plan of action and milestones is owned by the organization, which records each weakness, its remediation approach and dates, and it is reviewed by the authorizing official. Before fieldwork, confirm who signs each document and where the finding severity definitions live, because gaps in that ownership are a common reason packages stall.

An assessment report is not a certificate. It states findings for the assessor's stated scope, and it does not say that the system is secure or approved. The authorizing official makes the authorization decision, weighing the residual risk shown in the package against the organization's risk tolerance, and the assessor has no part in that decision. The assessor's independence rules, set by the authorizing official under SP 800-53A, protect that separation. Ask the authorizing official in advance which findings they expect to see closed, which may remain on the plan of action and milestones and what residual risk they are prepared to accept, so that remediation is aimed at the decision rather than at the report alone.

Who does what during an assessment

Your organization owns the system, its controls and the risk it accepts. The system owner and security team are accountable for each control being implemented and operating as described in the system security and privacy plan. The authorizing official, not the assessor or the partner, decides whether residual risk is acceptable and whether to grant an authorization to operate. You also decide what the assessor may examine and who speaks for each control during interviews.

Usually handled in-house: the system security and privacy plan, control ownership, the risk acceptance decision and the plan of action and milestones.
Usually handled in-house: policies, procedures and rules of behavior, since these are organizational documents that the assessor examines.
Usually handled in-house: the authorizing official's assessor independence determination, which is based on the system's categorization and risk.
Often contracted out: configuration evidence collection, log exports and documentation drafting, provided your staff reviews and approves every artifact.
Not outsourced: signing the authorization package and accepting residual risk.

Check that each control has a named owner, that the plan matches the system as deployed, and that the authorizing official has documented the independence level you require.

What must be in place before the assessor arrives

An SP 800-53A assessment tests what the organization has actually built, documented and can show. The six items below connect the system boundary, the control set, the evidence, the remediation plan and the people, so a gap in one shows up quickly in the others.

A current system security plan

The system security plan must describe the boundary the assessor will test, including every component, interconnection and inherited control. A plan that describes a smaller or older system sends the assessment to the wrong objects. Check it with a walkthrough against a current architecture diagram and inventory, using a second reviewer who did not write the plan. Ask the partner to confirm in writing which boundary artifacts they will treat as the baseline for the assessment.

A documented control set with tailoring

The selected baseline, every tailoring decision, parameter values and any common or compensating controls must be recorded before testing begins. Assessors compare the implemented controls against the chosen set, so undocumented exclusions read as gaps. Check it by dry-running two or three controls from different families and confirming each tailoring entry traces to a rationale and an authorizing official decision. Ask the partner to confirm who approved each tailoring decision and where it is recorded.

Evidence mapped to procedure objects

Each determination statement in an SP 800-53A procedure points to assessment objects: specifications such as policies and plans, mechanisms such as configured systems, activities performed by people, and individuals. Map evidence to those four object types before the assessor asks. Check the map by picking a control, listing its examine, interview and test objects, and confirming a real artifact exists for each. Ask the partner to confirm which objects they expect to see sampled and in what form.

A repeatable evidence collection method

Evidence has to be gathered the same way each time, with the same queries, exports, timestamps and owners, so the assessor can reproduce results and the organization can refresh them for ongoing monitoring. Test the method by running a full collection for a small set of controls, then running it again a few days later and comparing outputs. Ask the partner to confirm the format and retention of collected artifacts and whether screenshots or exports are accepted.

A plan of action and milestones with owners

Controls that are not satisfied need a plan of action and milestones that names a responsible owner, a remediation approach and a target date for each weakness. Assessors read this document to judge whether gaps are known and managed. Check it by confirming each open item has an owner who can speak to it and that dates align with the monitoring cycle. Ask the partner to confirm how they will record findings against POA&M entries and how changes to dates are documented.

Named people available for interviews

Interview is one of the three assessment methods, and many determination statements depend on what an administrator, owner or operator says about an activity. Name the people who run each control area and confirm they can explain their role and point to records. Check availability by scheduling a short mock interview on two or three controls with a colleague playing the assessor. Ask the partner to confirm the interview schedule, who may attend and whether interview notes are shared back for accuracy.

How to choose an assessor or consultant for SP 800-53 work

An assessor issues findings on your controls, a consultant prepares systems and evidence, and the authorizing official decides whether risk is acceptable. Choosing a partner means confirming who has authority to assess, how independent they are, and what they will actually test before any work starts.

Confirm who has assessment authority

Ask who sets assessor requirements for your program: the authorizing official for an agency system, or the program's own rules for a cloud service. For FedRAMP work, confirm the assessing organization is a FedRAMP Recognized service before you sign. A firm that is not recognized cannot supply the independent assessment FedRAMP requires, however capable its staff are.

Check independence and conflicts

SP 800-53A says the authorizing official sets the level of assessor independence based on system categorization and risk. Ask the candidate to disclose any role in designing, building or operating the system, and any consulting work it has done on the same controls. A partner that helped implement a control should not be the one that tests it, unless your authorizing official has approved that arrangement in writing.

Verify experience with your system and baseline

Ask for examples of assessments on systems of similar type, such as cloud-hosted, on-premises or hybrid, at the same impact level and baseline. Ask which parts of the control set the team has tested most often, such as access control, audit logging or configuration management. Request named roles and the credentials of the lead assessor, and confirm that those people, not only the firm, will do the work.

Ask which procedures and methods they will run

Ask which SP 800-53A assessment procedures the team will apply to each control, and which methods it will use: examine, interview or test. Ask how it sets depth (basic, focused or comprehensive) and coverage for each method, and how it chooses assessment objects such as specifications, mechanisms, activities and individuals. A proposal that lists only document reviews for every control signals a thin assessment.

Clarify what they will and will not sign

Only an independent assessor, certification body or the responsible official can issue an assessment report or attestation. A consultant can prepare the system security plan, evidence and remediation tracking, but must not sign the assessment report or claim the system is authorized. Get the partner to state in writing which documents it will author, which it will review, and which it will never sign.

Get a written scope before work starts

Require a written scope that names the controls and baseline in play, the procedures and methods, the sampling approach, the evidence the team will request, the findings process and the deliverables with dates. Agree how findings will be classified as satisfied or other than satisfied and who decides severity. Keep the scope, deliverables and timelines in the signed statement of work so that changes are tracked rather than absorbed.

Questions buyers ask before an SP 800-53 assessment

What drives the effort of an SP 800-53 assessment?

The biggest driver is how many controls the assessment must cover, which follows from the baseline selected for the system, any tailoring, and how many controls are inherited from common control providers. Depth and coverage also matter: SP 800-53A sets each assessment method at basic, focused or comprehensive, and the authorizing official chooses those values according to assurance requirements. Other drivers are the state of existing documentation, the number of system components in scope, and whether the assessor must test mechanisms or only review documents. Ask the assessor to show which controls and assessment methods they plan to cover before agreeing on effort.

Does NIST publish a cost or timeline estimate for an SP 800-53 assessment?

No. NIST does not estimate certification or compliance costs and does not set federal implementation timelines, which it leaves to OMB Circular A-130. The practical answer comes from a written scope that lists the system boundary, baseline, assessment depth and coverage, the assessor's named deliverables, and the dates each party must meet. Any figure you see elsewhere should be checked against that scope. Ask each provider to price the same scope so the quotes can be compared line by line.

Can our organization run the SP 800-53 assessment itself?

Your organization can prepare for an assessment, but it cannot be the independent assessor for its own system when independence is required. The authorizing official decides the level of assessor independence based on the system's categorization and risk, and an independent assessor must be free of perceived or actual conflicts of interest. Internal staff can run self-assessments, gather evidence, perform test procedures and fix findings, which strengthens the package before an independent team arrives. Confirm with the authorizing official whether internal assessment is acceptable for your system.

What does the assessment need from our internal staff?

The assessment needs named owners who can explain how each control is implemented and produce the supporting material. In practice this means:

A system owner who can confirm the boundary, components and data flows
Control owners for access, logging, configuration, incident response and contingency planning
Administrators who can demonstrate mechanisms during test procedures
Staff who can answer interview questions accurately and who know where policies, plans and records are kept
A point of contact who can track findings and plan of action and milestones items through closure

Plan these people's time before the assessment starts, because interview and test methods depend on their availability.

Can an implementation partner also perform the independent assessment?

Only where the authorizing official accepts the independence arrangement. An implementation partner can prepare systems, configure controls, produce documentation and collect evidence, and that work is often separate from the assessment. Assessing a system you helped build creates a conflict of interest that many authorizing officials will not accept. DeployOpen prepares systems, controls and evidence for assessments but does not issue assessment reports, attestations or authorizations. Ask the authorizing official in writing whether a given partner's role is acceptable before you contract for it.

What do FedRAMP's 3-month and 9-month rules mean for planning?

For providers applying for Class B, C or D certification, FedRAMP's Consolidated Rules for 2026 require a fresh initial independent assessment by a FedRAMP Recognized service completed within the previous 3 months. An assessment more than 9 months old cannot be refreshed, so the assessment must be redone. Plan the assessment to finish close to the application date, and build a schedule that leaves room for findings remediation inside that window. Check the current rules directly before you set dates, because the rules are updated.

What should we ask for in a quote for an SP 800-53 assessment?

Ask for a written scope that names the system boundary, the baseline or control set, the assessment depth and coverage for each method, and the list of controls to be assessed. Request the deliverables by name, such as the assessment report and the findings list, and the dates for each. Also ask which tasks are fixed-scope and which are time-and-materials, what is one-time and what recurs, what is excluded, how change requests are priced, and who holds responsibility for each control. Confirm the provider's independence position in writing.

How DeployOpen prepares systems and evidence before an assessment

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so the systems and evidence are ready for an independent NIST 800-53 assessment. We prepare controls and evidence only; the organization owns its controls, and an independent assessor performs the SP 800-53A assessment and issues the findings.

How we scope

Engagements are fixed-scope, with the systems, control families and deliverables agreed in writing before work starts.
The written scope names which SP 800-53A assessment methods and objects each control set will be prepared against.
Scope records which controls are inherited from common control providers and which the organization must still evidence.

How we build

We configure self-hosted platforms in your cloud accounts, data centers or air-gapped networks to match the agreed control set.
Each control is mapped to its determination statements so examine, interview and test evidence can be produced on request.
Logging, configuration baselines and access settings are built to generate evidence that an assessor can sample and re-check.

How we hand over

We deliver the system documentation, configuration records and evidence index in a format your assessor can review directly.
Known gaps are recorded as findings with owners and remediation steps, so the plan of action and milestones reflects reality.
Handover includes a walkthrough so your internal staff can explain how each control operates during interviews and testing.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Retainers can cover evidence refreshes between assessments, including documentation updates after significant changes.
Independent assessment, authorization decisions and any issued reports remain with your assessor and authorizing official.