CA-02 Control Assessments
Security Assessment and Authorization
Description
a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls and control enhancements under assessment; 2. Assessment procedures to be used to determine control effectiveness; and 3. Assessment environment, assessment team, and assessment roles and responsibilities; c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; d. Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements; e. Produce a control assessment report that document the results of the assessment; and f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].
Supplemental Guidance
Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented. Organizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes. Organizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs. Organizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives. To satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of CA-02.
Changes from Rev 4
Title changed from 'Security Assessments' Control text is more generic and drops security emphasis Discussion includes need to ensure control assessors possess required skills and technical expertise and results reviewed and approved by the authorizing official or designee Addresses withdrawn App J control AR-04
Enhancements (3)
What NIST adds to this control. Select one to read its statement.
CA-02(01) Independent Assessors ModerateHigh
Employ independent assessors or assessment teams to conduct control assessments.
CA-02(02) Specialized Assessments High
Include as part of control assessments, [Assignment: organization-defined frequency], [Selection (one): announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]].
CA-02(03) Leveraging Results from External Organizations
Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].
Patterns that use this control (28)
Grouped by the emphasis each pattern gives it.
Critical (4)
Important (19)
- SP-006 Wireless- Private Network Pattern
- SP-007 Wireless- Public Hotspot Pattern
- SP-008 Public Web Server Pattern
- SP-011 Cloud Computing Pattern
- SP-012 Secure Software Development Lifecycle
- SP-019 Secure Ad-Hoc File Exchange Pattern
- SP-026 PCI Full Environment
- SP-027 Secure LLM Usage
- SP-028 Secure DevOps Pipeline Pattern
- SP-029 Zero Trust Architecture
- SP-030 API Security
- SP-033 Passkey Authentication
- SP-034 Cyber Resilience
- SP-036 Incident Response
- SP-037 Privileged User Management
- SP-038 Vulnerability Management and Patching
- SP-042 Third Party Risk Management
- SP-045 AI Governance and Responsible AI
- SP-046 External Attack Surface Management
MITRE ATT&CK Techniques (5)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.