{"data":{"id":"CA-02","name":"Control Assessments","family":"CA","family_name":"Security Assessment and Authorization","withdrawn":false,"description":"a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;\nb. Develop a control assessment plan that describes the scope of the assessment including:\n1. Controls and control enhancements under assessment;\n2. Assessment procedures to be used to determine control effectiveness; and\n3. Assessment environment, assessment team, and assessment roles and responsibilities;\nc. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;\nd. Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;\ne. Produce a control assessment report that document the results of the assessment; and\nf. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].","supplemental_guidance":"Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented.\n\nOrganizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes.\n\nOrganizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs.\n\nOrganizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives.\n\nTo satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of CA-02.","enhancements":[{"id":"CA-02(01)","name":"Independent Assessors","statement":"Employ independent assessors or assessment teams to conduct control assessments.","baselines":["moderate","high"]},{"id":"CA-02(02)","name":"Specialized Assessments","statement":"Include as part of control assessments, [Assignment: organization-defined frequency], [Selection (one): announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]].","baselines":["high"]},{"id":"CA-02(03)","name":"Leveraging Results from External Organizations","statement":"Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CA-02","name":"Control Assessments","description":"a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;\nb. Develop a control assessment plan that describes the scope of the assessment including:\n1. Controls and control enhancements under assessment;\n2. Assessment procedures to be used to determine control effectiveness; and\n3. Assessment environment, assessment team, and assessment roles and responsibilities;\nc. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;\nd. Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;\ne. Produce a control assessment report that document the results of the assessment; and\nf. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].","discussion":"Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented.\n\nOrganizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes.\n\nOrganizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs.\n\nOrganizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives.\n\nTo satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of CA-02.","related_controls":["AC-20","CA-05","CA-06","CA-07","PM-09","RA-05","RA-10","SA-11","SC-38","SI-03","SI-12","SR-02","SR-03"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":true,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Security Assessments' Control text is more generic and drops security emphasis Discussion includes need to ensure control assessors possess required skills and technical expertise and results reviewed and approved by the authorizing official or designee Addresses withdrawn App J control AR-04"}},"compliance_mappings":{"iso_27001_2022":["8.1","9.2","A.5.30","A.5.35","A.5.36","A.8.29","A.8.34"],"iso_27002_2022":["5.35","5.36","8.29","8.34"],"cobit_2019":["APO11","APO13","BAI07","MEA02","MEA03","MEA04"],"pci_dss_v4":["12.4","12.5"],"nist_csf_2":["GV.OV-02","GV.OV-03","ID.IM-01","ID.IM-02","ID.IM-03","ID.RA-01"],"cis_controls_v8":["CIS 15.5","CIS 18.4"],"soc2_tsc":["CC1.1-POF3","CC3.1","CC4.1","CC5.2","CC6.1-POF2"],"finos_ccc":[],"iso_42001_2023":["A.5.2","A.5.3","A.6.2.4"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(f)","Art. 24","Art. 32"],"apra_cps_234":["Para 22-23","Para 24","Para 27-28"],"mas_trm":["13"],"pra_op_resilience":["SS1/21-7.1","SS2/21-6.2"],"bsi_grundschutz":["ORP.5"],"anssi":["Hygiene.3","Hygiene.31","Hygiene.41","RGS.4.1","SecNumCloud.19.2"],"osfi_b13":["B-13.1.3","B-13.3.5"],"finma_circular":["IV.D(75)","IV.D(76)","IV.D(77)"],"gdpr":["Art.32(1)(d)","Art.35(1)","Art.35(7)"],"dora":["Art.6(4)","Art.24(1)","Art.24(2)","Art.25(1)"],"bio2":["5.35","5.36","8.29","8.34"],"rbi_csf":["Annex1.18","ITGRCA.26","ITGRCA.30"],"fisc":["FISC.O7"],"lgpd_bcb":["BCB.Art.10","BCB.Art.18","BCB.Art.19","LGPD.Art.37-38","LGPD.Art.50"],"hkma_tme1":["TME1.2.6","TME1.3.3","TME1.7.4"],"mlps_2":["8.1.7.2","8.1.9.5","8.1.9.6"],"dnb_good_practice":["DNB.10.4","DNB.16.1","DNB.16.2","DNB.16.3","DNB.16.4","DNB.16.5","DNB.22.1"],"cra":["CRA.I.2a","CRA.II.3"],"swift_cscf":[],"cbb_tm":["TM-16"],"cbuae":["CR-10","CR-14"],"nca_ecc":["1-7","1-8"],"qatar_nia":["GV","OS","RM","SD"],"sama_csf":["1.3","1.9","2.2","4.2"],"bog_cisd":["CISD-COMP","CISD-ISMS","CISD-IV"],"bom_ctrm":["1.5","3.1","4.3","5.4"],"cbe_csf":["GOV-3","OVM-3"],"cbn_csf":["Part2.3","Part5.1","Part6.2","Part7.2"],"popia":["s19"],"sa_js2":["JS2-6.2","JS2-7.7","JS2-9"],"bcbs_239":["Principle 7","Principle 8","Principle 12"],"bot_cyber":["Ch1.3","Ch3.2","Ch6.1"],"cpmi_pfmi":["CG.LE","CG.TE","PFMI.P3","PFMI.P17"],"eba_ict":["3.3.6","3.4.6"],"ecb_croe":["CROE.2.2.1","CROE.2.6.1","CROE.2.8.1"],"ffiec_is":["Appendix A","II.A","II.A.2","II.B","II.C.3","II.C.4","II.D","IV.A","IV.A.1","IV.A.2","IV.A.3","IV.A.4"],"hipaa_sr":["§164.308(a)(1)(i)","§164.308(a)(1)(ii)(A)","§164.308(a)(7)(ii)(D)","§164.308(a)(8)"],"iosco_cyber":["LE-2","SA-3","TEST-1","TEST-3","TEST-4"],"nydfs_500":["500.2","500.9"],"sebi_cscrf":["AUDIT","CCI","CERTIF","DE.VA","GV.OV","RC.IM","RS.IM","VAPT"],"cmmc_2":["CA","RA"],"nerc_cip":[],"nrc_73_54":["RG5.71-C-CA","RG5.71-C-PL"],"tsa_psd":["SD-1 Sec 3","SD-2 Sec G"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":["Sec 15"],"awia":[],"iaea_nss":["Sec 11"],"pci_pts":[],"fips_140":[],"cbest":["CBEST.7","CBEST.10"],"tiber_eu":["TIBER.CLOSE","TIBER.REM"],"pci_hsm":["10"],"common_criteria":["CC Part 3 — SAR","CEM"],"isae_3402":["Clause 2","Clause 3","Clause 5","Clause 6","Clause 10"],"fca_sysc_13":["SYSC 13.5.3","SYSC 13.G.3"],"fda_21_cfr_11":["§11.10(a)","§11.300(e)"],"fda_cyber":["524B-4","SPDF-2"],"hitrust_csf":["00.b","04.b","06.c","12.c"],"iso_27799":["18.3","18.4"],"lloyds_ms":["MS10.2"],"naic_ds":["4","4-monitoring","4A","4E","7"],"nhs_dspt":["NDG-5.1","NDG-7.3"],"pra_ss1_23":["P2.2","P4.1","P4.2"],"solvency_ii":["Art.45","Art.46","Art.47","DR.266","EIOPA-Cloud-GL7","EIOPA-ICT-4.2"],"owasp_masvs_v2":[],"csa_ccm_v4":["AA-01","AA-02","AA-03","AA-04","AA-05","AA-06","CEK-09","GRC-07","STA-05","STA-06","STA-11","STA-12","STA-13"],"csa_aicm":["A&A-01","A&A-02","A&A-03","A&A-04","A&A-05","A&A-06","CEK-09","GRC-07","GRC-12","STA-05","STA-06","STA-11","STA-12","STA-13"],"ccss_v9":["1.01.6","2.01.1","2.01.2","2.01.3","2.02.3","2.03.1","2.03.2"],"mica":["Art.34(5)","Art.43(1)","Art.94(1)","Art.111(1)"],"basel_sco60":["SCO60.5","SCO60.14","SCO60.21","SCO60.41","SCO60.51","SCO60.52","SCO60.64","SCO60.65","SCO60.74","SCO60.85"],"bssc":["GSP-10","GSP-15","TIS-02","TIS-06"],"sec_custody_digital":["SEC-CD-01","SEC-CD-10","SEC-CD-13","SEC-CD-14","SEC-CD-17"],"dpdpa":["Act.8(4)","Act.10(2)(b)","Act.10(2)(c)","Rules.6(1)(g)","Rules.13(1)-(2)","Rules.Sch1.A.9","Rules.Sch1.B.12"]},"attack_techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Regular security assessments identify vulnerabilities in public-facing applications before adversaries can exploit them for initial access, validating that input validation, patching, and protective controls are implemented correctly and operating as intended."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Security assessments that include supply chain risk evaluation verify the integrity of third-party software and hardware components, increasing the likelihood of detecting tampered or compromised elements before they are deployed into the operational environment."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Periodic assessment of internal service configurations and patch levels identifies exploitable vulnerabilities in remote services, enabling remediation before adversaries can leverage these weaknesses for lateral movement across the network."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Security assessments covering development tool chains and dependency management practices detect compromised software libraries or build tools, reducing the risk that adversaries inject malicious code through trusted development dependencies."},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Assessing the software supply chain—including vendor integrity verification, code signing validation, and distribution channel security—increases the probability of detecting compromised software packages before they enter the production environment."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.30 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 ID.IM-02, ID.IM-03, ID.RA-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-006","SP-007","SP-008","SP-011","SP-012","SP-018","SP-019","SP-021","SP-023","SP-025","SP-026","SP-027","SP-028","SP-029","SP-030","SP-033","SP-034","SP-035","SP-036","SP-037","SP-038","SP-041","SP-042","SP-043","SP-044","SP-045","SP-046"]}}