RA-1 Policy and procedures
The risk assessment policy and procedures: who owns them, the level they apply at, review frequency and triggering events, and how this -1 control sets the governance frame for every other RA control.
RA Risk assessment
Risk assessment family: security categorization, risk assessments, vulnerability monitoring and scanning, risk response, privacy impact assessments, criticality analysis and threat hunting.
RA-2 Security categorization
Security categorization under FIPS 199: assigning impact levels to the system and its information, documenting the rationale, and getting authorizing official approval. This decision selects the baseline for every other control.
RA-3 Risk assessment
Conducting, documenting and updating security and privacy risk assessments: threats, vulnerabilities, likelihood, impact, the risk assessment report, review cycles and the supply chain risk enhancement that FedRAMP requires.
RA-5 Vulnerability monitoring and scanning
Vulnerability monitoring and scanning: scan frequency and coverage, authenticated scanning, update of vulnerability signatures, remediation timeframes, scan evidence and how FedRAMP ties this control to its vulnerability detection and response rules.
RA-6 Technical surveillance countermeasures survey
Technical surveillance countermeasures surveys that look for listening devices and other technical surveillance at sensitive locations. A specialized, physical-security control outside every SP 800-53B baseline.
RA-7 Risk response
Risk response: accepting, mitigating, transferring or avoiding risk identified by assessments, monitoring and audits, and the plan of action and milestones that records each decision.
RA-8 Privacy impact assessments
Privacy impact assessments for systems, programs and new PII collections: when one is required, what it analyzes and how it feeds privacy risk decisions. Assigned only to the SP 800-53B privacy baseline.
RA-9 Criticality analysis
Criticality analysis: identifying which components and functions are mission critical so that supply chain, engineering and protection effort can be prioritized. Rev. 5 incorporated the withdrawn SA-14 into it.
RA-10 Threat hunting
Threat hunting: a proactive capability that searches for indicators of compromise and adversaries that evade existing defenses, how often hunts run and what evidence shows the capability exists. Not in any SP 800-53B baseline.
