NIST 800-53 security assessment report (SAR) contents

What the NIST 800-53 security assessment report contains and who issues it

When a contract, agency or FedRAMP-style authorization requires a NIST 800-53 security assessment report (SAR), the report is produced by an independent assessor under control CA-2, using the determination statements and assessment methods in SP 800-53A. The authorizing official relies on the SAR together with the system security plan and the plan of action and milestones (POA&M) when deciding whether to authorize the system to operate. Your organization owns its controls and is accountable for them, an implementation partner can prepare systems, configurations and evidence for the assessor, but only the independent assessor issues the report. Confirm in writing who the assessor is, whether that assessor meets any independence requirement your authorizing body sets, and that your partner's role is limited to preparing material for the assessor to examine.

Under CA-2 the assessor's report sits inside an assessment plan that the authorizing official must approve before testing begins. Check that the plan defines scope, procedures and roles, because the SAR can only cover what that plan covers. For each determination statement the assessor records a finding of satisfied or other than satisfied, and an other-than-satisfied result may also mean the assessor could not obtain enough information. Ask how the assessor will record evidence for each finding and how it will apply the depth and coverage attributes that SP 800-53A defines, since those settings decide how much evidence the report reflects. Where a comparable report already exists, SP 800-37 Rev. 2 allows it to serve as the assessment report if it meets the content requirements, so confirm that with the authorizing official before commissioning new work. Ask the assessor to show the report structure before testing starts.

Cost and duration depend on scope and on how mature your evidence is. Assessment effort grows with the number of controls in the selected baseline, the number of system components, the number of enhancements that apply, and how much evidence must be gathered manually. Scope decisions that take a long time to settle, such as whether shared services are inherited or assessed in the system, also change the work. Ask any assessor or partner for a written scope that lists the baseline, boundary, assessment methods and deliverables, and ask which costs are one-time (plan preparation, first assessment) and which recur (annual or periodic assessments, re-testing after significant change). No figures are given here because a credible estimate needs a written scope. Once you have one, a NIST SP 800-53A review will help your team check the assessor's procedures against the controls in scope.

How the assessment report is produced from plan to final SAR

The sequence turns CA-2 into a finished assessment report that an authorizing official can rely on, with each phase producing a named artifact that the next phase depends on. The independent assessor runs the testing and writes the findings, while the organization and its implementation partner supply systems, documentation and evidence.

Select an appropriate assessor or team
The organization chooses the assessor or assessment team that will test the controls, based on the independence the system's baseline calls for and the specialized skills the scope needs. Under the moderate and high baselines, SP 800-53B Release 5.2.0 selects CA-2(1), which covers independent assessors, and the high baseline also selects CA-2(2), which covers specialized assessments. The output is a documented selection and an agreed statement of who will assess, which the authorizing official can see before testing begins. The assessor performs the testing; an implementation partner preparing systems and evidence does not sign or execute the assessment.
Write the assessment plan
The assessor drafts the assessment plan, which CA-2 requires to cover scope, the assessment procedures to be used and the roles of the people involved. Scope identifies the system, its boundary, the controls and enhancements in the baseline or tailored set, and any inherited common controls. Procedures reference the SP 800-53A assessment procedures and the depth and coverage values chosen for each. The output is a written plan that lists every control to be assessed and the methods that will be applied to it.
Obtain authorizing official approval of the plan
The authorizing official reviews the assessment plan and approves it before testing starts. This approval confirms that the scope, procedures and depth and coverage choices match the assurance the authorization requires, and it fixes the baseline against which findings will later be judged. The output is a signed or recorded approval, with any changes to scope or procedures returned to the assessor and re-approved. Changes made after approval should be tracked so the final report can show what was tested under which plan.
Execute examine, interview and test methods
The assessor carries out the methods named in the plan. Examine reviews documents, configurations, records and mechanisms. Interview asks the people who run and use the system how the control works in practice. Test exercises the mechanism to see whether it behaves as the control requires. SP 800-53A specifies examine for most determination statements, interview for a large share and test for a smaller set, so the plan determines which methods are used for each item. The output is working papers that record what was reviewed, who was interviewed, what was tested and the results observed.
Record a satisfied or other-than-satisfied finding for each determination statement
Each determination statement in an SP 800-53A procedure produces one finding: satisfied (S) or other than satisfied (O). An O finding can mean the control is missing or wrong, or it can mean the assessor could not obtain enough information to make a determination. Where the organization has defined severity subcategories for O findings, the assessor applies them. The output is a finding for every determination statement in scope, with the evidence and reasoning behind it, so that a reviewer can trace each conclusion back to the artifacts examined.
Draft the assessment report
The assessor consolidates the working papers into the assessment report. The report states the scope and methods used, the depth and coverage applied, the findings for each control and enhancement, and the assessor's overall results. SP 800-37 Rev. 2 describes the assessment report as a key document in the authorization package developed for the authorizing official. The output is a draft that the organization can check for factual accuracy, such as system names, version references and evidence locations, without changing the assessor's findings.
Share results and hand the report to the authorizing official
CA-2 requires the assessment results to be shared with the appropriate organizational officials. The final report is delivered to the authorizing official and included in the authorization package, along with the findings that feed the plan of action and milestones for any O findings. The output is the final, dated assessment report with its distribution recorded. Open findings then move into remediation and reassessment, which the program tracks under the POA&M and continuous monitoring processes.

What CA-2 requires the assessment report to show

CA-2 asks the organization to run a structured assessment of its security and privacy controls and to record the results in a report that others can rely on. In plain terms, the organization must choose an appropriate assessor or assessment team, write an assessment plan that sets out scope, procedures and roles, and get the authorizing official to approve that plan before testing starts. Controls are assessed at a defined frequency to confirm three things: that they are implemented correctly, that they operate as intended, and that they produce the desired outcome. The results then have to be written up as an assessment report and shared with the people who need them. The report is the artifact the authorizing official reads, so its contents follow directly from what the plan promised to cover. You can review the control's wording and its enhancements in the NIST CPRT entry for CA-02.

Two enhancements change who must do the work and how deep it goes, and SP 800-53B Release 5.2.0 decides which baselines include them. CA-2(1) calls for independent assessors and is selected in the moderate and high baselines. CA-2(2) calls for specialized assessments such as simulated attacks, and is selected in the high baseline only. For a moderate system, the assessor therefore needs to be organizationally separate from the teams that built and operate the controls. For a high system, the plan also has to say where specialized testing fits and who performs it. Confirm the impact level and baseline of your system with your authorizing official before you scope the assessment, because those two facts determine whether independence and specialized testing appear in the plan at all.

Before the assessment begins, check three things against the plan: that the assessor is independent where CA-2(1) applies, that the plan names the controls, methods and roles it will use, and that the authorizing official has signed the approval. Then confirm that the report will show, for each control assessed, what was examined, who was interviewed, what was tested and what the result was. If your organization already uses an external assessor or a comparable report, ask whether that document covers the same content as the plan, because the report's usefulness to the authorizing official depends on it. Ask your assessor to state the scope and independence of the team in writing so the report's claims can be traced back to the plan.

How determination statements become satisfied or other-than-satisfied findings

Every SP 800-53A procedure breaks a control into determination statements, and each one ends as a finding the authorizing official can read. The cards below follow that path, from the statement itself to the methods and the counts that size the work.

Determination statements per procedure

Each SP 800-53A procedure is a list of determination statements, the testable claims that together show a control is met. Across the Release 5.2.0 OSCAL catalog there are 2,776 determination statements covering 1,014 active controls and enhancements. Use that total to size the assessment plan, but read the statements for the systems you actually assess, because a statement that does not apply to your scope still needs a documented disposition in the report.

Satisfied (S) findings

A satisfied finding means the assessor has enough evidence to conclude that a determination statement is met. The assessor must record the objects examined, people interviewed or tests run so the finding can be traced. A statement marked satisfied without that trail will not survive review by the authorizing official or an independent reviewer, so check each S finding against its supporting evidence before the report is finalized.

Other than satisfied (O) findings

An other-than-satisfied finding means the statement is not met, or the assessor cannot show that it is. Each O finding feeds the plan of action and milestones and the authorization decision, so it must state the gap in specific terms. Organizations may define severity subcategories for O findings, and those labels should be agreed with the authorizing official before assessment begins so that ratings are consistent across controls.

Insufficient information as an O finding

Other than satisfied also covers the case where the assessor could not obtain enough information to decide. A missing log export, an unreachable interview subject or a test that could not run is recorded as an O finding, not left blank or assumed to pass. Ask the assessment team to log each evidence request and its outcome, because a pattern of unanswered requests is itself a finding about how the organization produces evidence.

Examine, interview and test methods

The Release 5.2.0 OSCAL content specifies the examine method for 1,013 of the controls and enhancements, interview for 1,012 and test for 906. Those counts show that most procedures expect documents or configurations to be examined, most expect people to be interviewed, and somewhat fewer expect technical tests. Plan for all three methods on most controls, and confirm test requirements early because they usually need access to live systems or test environments.

Assessment objects and depth and coverage

Each method names suggested assessment objects, such as policies, configurations, mechanisms, personnel or samples of systems. These are starting points, not a fixed list. The assessor sets depth and coverage for each method, choosing basic, focused or comprehensive values based on the assurance the authorizing official requires. Record both settings in the assessment plan, because they determine how much evidence supports each finding in the report.

How depth and coverage change the rigor of each finding

Basic settings ask the assessor to confirm that the expected artifact or behavior exists and is generally in place. The assessor examines a limited set of documents, runs a short interview with a control owner and performs a light functional check where the procedure calls for one. Basic settings suit controls where the organization's assurance need is modest or where other controls already provide strong evidence for the same objective.

Examine: The assessor reviews the principal policy, procedure or configuration record and does not sample beyond it.
Interview: One knowledgeable role, such as the control owner, answers the questions in the procedure.
Test: The assessor observes a single representative run of the mechanism, if the procedure includes a test method at all.
Coverage: Assessment objects are drawn from a small set of representative components rather than every component in the boundary.
Finding risk: A satisfied result at this level says less about consistent operation, so the report should state the setting plainly.

Confirm with the authorizing official that a basic setting is acceptable for each control before the assessor begins, and record the reason in the assessment plan.

Dedicated SAR or comparable report: which fits the authorization

This table compares a dedicated assessment report written for the system with a comparable report from an earlier or parallel assessment. Read each row as a question to answer before the authorizing official is asked to rely on either document. The main takeaway is that reuse is possible only when the existing report meets the content requirements and the authorizing official accepts it.

Option	When it fits	What must be checked	Who decides
Dedicated SAR	The system has no prior assessment, its boundary or components changed substantially, or the earlier report covers different controls, scope or environment.	Assessment plan approved under CA-2, assessor independence, determination statements for each selected control, and findings traceable to evidence.	The organization selects the assessor and approves the plan. The authorizing official accepts the report.
Comparable report from an earlier assessment	The same system was assessed recently under the same baseline and boundary, with no significant change since the assessment.	Date of assessment, system version and boundary, control baseline, assessment depth and coverage, and whether the report includes findings for every control in scope.	The authorizing official decides whether it is acceptable. The organization confirms it still describes the system.
Comparable report from a parallel assessment	A separate authorization or common control assessment covers the same controls and components, such as shared infrastructure inherited by this system.	Which controls are inherited and which are system-specific, the assessor's qualifications, and whether the scope matches the system's boundary.	The authorizing official decides. Both the owning and inheriting authorizing officials may need to agree on inherited results.
Partial reuse with supplemental testing	Most controls are covered by a comparable report, but a few areas changed or were not assessed in the original.	A gap list of controls and enhancements not covered, supplemental assessment plan for those items, and the combined report content.	The organization defines the supplement. The authorizing official decides whether the combined package is acceptable.
Report from an assessor without independence	An internal team or the system owner performed the assessment and the authorization depends on independent review.	Whether CA-2(1) applies at the chosen baseline and whether the assessor is separate from development and operation.	The authorizing official decides whether the assessor meets the requirement. Confirm baseline selections in SP 800-53B.
Report reused for a different authorizing official	Another office or agency wants to rely on an existing authorization package.	Acceptance criteria stated by the new authorizing official, currency of findings, and open items in the POA&M.	The new authorizing official decides. Agreements with the originating organization may also apply.

When a comparable report can stand in for a new SAR

A comparable report can replace a new assessment report only if it passes three tests: it meets the content requirements for an assessment report, it covers the system and every control inside the authorization boundary, and the authorizing official accepts it. SP 800-37 Rev. 2 says a comparable report that meets those content requirements can itself serve as the assessment report, so the question is never whether the document has a familiar name. It is whether the document contains what the authorizing official needs to make a risk decision today. The NIST SP 800-37 Rev. 2 page on CSRC is the reference to check against before you start.

Start the review with scope. Confirm the report's system name, boundary description, version and date, and compare them with the current system security and privacy plan. A report written for an earlier architecture, a different hosting location or a smaller boundary will not cover components added since. Next, check assessor independence wherever CA-2(1) applies. In the moderate and high baselines, the report should show that the assessor was independent of the people who designed, operated and configured the system. Ask for the assessor's role statement and the assessment plan that the authorizing official approved. If either is missing, treat the report as incomplete until the gap is closed.

Then read the findings control by control. Each determination statement in SP 800-53A should have a recorded satisfied or other-than-satisfied result, and the depth and coverage attributes used for each method should be stated. Gaps usually appear in two places: procedures that were planned but not recorded, and controls the earlier scope excluded, such as inherited controls, components added later or families that were out of scope at the time. Where a control is missing, the reuse decision is not yet supported, and the cheapest path is often a targeted assessment of those controls rather than a full new report. Confirm the scope and any cost or timing for that work with your assessor, because they depend on the size of the gap.

What must be in place before the assessor starts testing

An assessor can only test what is documented, scoped and reachable. The cards below cover the six items an authorizing official will expect to see lined up before testing begins, and each one includes a check the reader can run before the assessment window opens.

A current system security plan

The assessor tests controls against the system as it actually runs, so the system security and privacy plan must match the current boundary, components and data flows. Check that the PL-2 content reflects the latest architecture, that each control lists its implementation and responsible role, and that inherited controls name the provider whose evidence will be examined. A plan written for an earlier design will produce findings that have nothing to do with the control itself.

An approved assessment plan

CA-2 requires an assessment plan that covers scope, procedures and roles, and the authorizing official must approve it before testing starts. Check that the plan names every system in scope, the depth and coverage chosen for each assessment method, and the assessor or team selected. If the authorizing official has not signed off, the findings may later be challenged as tested against the wrong target.

Control implementation evidence

Assessors examine artifacts for each control, so every control needs evidence that is current, dated and tied to the system before testing begins. Walk through a sample of controls and confirm that configuration exports, access reviews, scan results and training records exist for the assessment period. Gaps found at this stage are cheaper to close than gaps found by the assessor during examination.

A POA&M for known weaknesses

Known weaknesses should appear in a plan of action and milestones before the assessor finds them, with a responsible owner and a scheduled action for each item. Check that every open finding from prior scans, reviews and assessments is recorded, that severity and status fields are current, and that accepted risks carry a documented authorizing official decision. A missing or stale POA&M suggests that the program does not track its own weaknesses.

Named interviewees for each role

Interview methods only work when the right people are available and can speak to their controls. Check that each role in the assessment plan, including system owner, security engineer, operations staff, HR and the incident response lead, has a named person and a backup. Confirm that interviewees have read the relevant procedures and can explain how the control works in practice, not only in policy.

Test access to systems and logs

Test methods require the assessor to run commands, review configurations and sample audit records, so read-only access to systems, logs and scanner output must be granted before fieldwork starts. Check that accounts are provisioned in a test or production tenant as agreed, that log retention covers the assessment period, and that any access requiring approval has been requested in advance. Access delays are one of the most common reasons assessment schedules slip.

Who does what: the organization, the implementation partner and the assessor

The organization owns its controls, its system and the decision to authorize it. Under CA-2, the organization selects the assessor or assessment team, develops the assessment plan covering scope, procedures and roles, and has the authorizing official approve that plan before testing starts. The organization also decides the assessment frequency and the depth and coverage its assurance requirements call for, and it receives and acts on the report. Staff must be available to answer interview questions and to walk assessors through configurations, procedures and records.

Owns the controls: Control implementation, operation and day-to-day evidence stay with the organization, whatever partner helped build them.
Approves the assessment plan: The authorizing official signs off on scope, procedures, roles and the selected assessor before fieldwork begins.
Sets assurance levels: The organization chooses the depth and coverage for each assessment method, which drives how much testing the assessor performs.
Provides interview staff: Named system owners, administrators and operators must be available for the interview method.
Acts on the results: Other-than-satisfied findings feed the plan of action and milestones and the authorization decision.

Before fieldwork starts, confirm in writing who approved the assessment plan and which staff members are assigned to each interview.

Questions buyers ask about the NIST 800-53 SAR

Who writes the security assessment report for SP 800-53?

The assessor writes it, not the organization being assessed and not DeployOpen. CA-2 requires the organization to select an appropriate assessor or team, and the assessment report records what that assessor examined, interviewed and tested. The organization owns its controls and approves the assessment plan through its authorizing official, but the findings in the report must come from the independent assessor. The assessor's independence level depends on the authorization context: CA-2(1) selects independent assessors in the moderate and high baselines, and CA-2(2) adds specialized assessments in the high baseline only. Ask any prospective assessor to explain how they meet the independence expectation for your system's impact level.

Can an implementation partner prepare the SAR for us?

An implementation partner can prepare the systems, control implementations and evidence that the assessor will review, but it cannot write the assessment findings or issue the report as an independent assessment. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. In practice, the partner can organize evidence against each SP 800-53A determination statement, document how each test was prepared, and help the internal team respond to assessor questions. Confirm in the written scope which artifacts the partner delivers and which remain the assessor's work product.

What does our organization need to supply for the assessment?

The organization must supply the authorization boundary, the system security and privacy plan, the assessment plan inputs, access to personnel for interviews, administrative and technical access for testing, and the evidence that shows each control is implemented. The assessor needs enough access to run the examine, interview and test methods that SP 800-53A specifies for each control. Expect to provide:

Current configuration baselines, logs and scan results that cover the stated scope
Policies, procedures and records that show the -1 and operational controls are in effect
Named points of contact for each control family and for system changes during the assessment
Any inherited control documentation from a common control provider

Confirm the exact list with the assessor before fieldwork starts, because the list depends on the baseline and scope.

Can a comparable report be used instead of a new SAR?

Yes, if the comparable report meets the content requirements for an assessment report. SP 800-37 Rev. 2 treats assessment reports as key documents in the authorization package and states that a comparable report meeting those content requirements can itself serve as the assessment report. The decision belongs to the authorizing official, who must be satisfied that the report covers the same system or common controls, the same scope, the same baseline and a sufficient depth and coverage. A report that tests a different boundary or omits determination statements usually cannot be reused as is. Ask the authorizing official in writing which prior reports they will accept before planning the assessment.

How are depth and coverage chosen for each assessment?

The organization chooses depth and coverage based on its assurance requirements, and SP 800-53A defines both with the values basic, focused and comprehensive. Depth controls the rigor of each method, from a lighter review of documents to more detailed examination and testing. Coverage controls the breadth of assessment objects, such as how many systems, components or samples the assessor examines. A system with higher impact or a stricter contract usually calls for higher settings, which increases the effort. Record the chosen values in the assessment plan and get the authorizing official's approval before fieldwork begins, because the SAR must show that the approved depth and coverage were actually applied.

What does an other-than-satisfied finding mean in the SAR?

An other-than-satisfied finding means the assessor could not conclude that a determination statement is satisfied. It does not automatically mean the control failed. SP 800-53A produces a satisfied or other-than-satisfied result for each determination statement, and other-than-satisfied can also mean the assessor lacked enough information to decide. The organization can define severity subcategories for these findings, which helps the authorizing official prioritize them. Each finding normally feeds into the plan of action and milestones, so the organization should agree in advance how it will document, track and retest these items.

Does NIST publish what an SP 800-53 assessment costs?

No. NIST does not estimate certification or compliance costs, and its risk management FAQ states that it does not offer or endorse any compliance program or tool. The cost of an assessment depends on the system boundary, the baseline, the chosen depth and coverage, the number of controls in scope, and whether the organization already has evidence in order. Ask each assessor for a quote that lists the work per control family, the testing hours, the travel and the report rework cycles. Ask whether the price includes re-testing after remediation, because that work recurs when findings are closed.

What makes an SP 800-53 assessment take longer?

Effort rises with the number of controls in scope, the number of components under test, the depth and coverage chosen, and how ready the evidence is when fieldwork starts. The SP 800-53A procedures contain 2,776 determination statements across the 1,014 active controls and enhancements in the Release 5.2.0 OSCAL catalog, so a larger baseline or a broader boundary multiplies the work. Delays often come from missing configuration records, unclear inheritance from shared services, and late changes to the system during assessment. Agree on a change freeze window and a single evidence owner before the assessment starts.

How DeployOpen prepares systems and evidence for the assessment report

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems and evidence behind each SP 800-53 control are ready for an assessor to test. We prepare the material; your organization owns its controls, and an independent assessor produces the assessment report.

How we scope

Engagements are fixed-scope, with the systems, controls and deliverables for the assessment report agreed in writing before work starts.
The written scope names which control families, baselines and assessment objects the preparation covers for the authorizing official.
Scope also records who owns each control, who acts as the independent assessor and where the assessment plan is approved.

How we build

We configure and harden the self-hosted platforms in your cloud accounts, data centers or air-gapped networks to match the agreed controls.
We test implemented controls against the determination statements in the SP 800-53A procedures so gaps surface before the assessor arrives.
We set up logging, configuration and scan outputs so each finding can be traced to a specific control and a dated piece of evidence.

How we hand over

We deliver the documented evidence, test results and control descriptions in a form your assessor can review independently.
We record open findings with the reasons they are other than satisfied, including cases where information could not be obtained.
We hand over the preparation documentation so your team can explain how each finding was produced to the authorizing official.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial written scope is delivered.
Retainers can keep control evidence current as platforms change, so later assessments draw on maintained records rather than rebuilt ones.
Confirm with your assessor which report format and depth they expect before scoping, since those requirements vary by organization.

NIST 800-53 security assessment report (SAR)