Assessment, Authorization, and Monitoring (CA)
The Assessment, Authorization, and Monitoring family has 8 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| CA-1 | Policy and Procedures | Yes | Yes | Yes | Yes |
| CA-2 | Control Assessments | Yes | Yes | Yes | Yes |
| CA-3 | Information Exchange | Yes | Yes | Yes | |
| CA-5 | Plan of Action and Milestones | Yes | Yes | Yes | Yes |
| CA-6 | Authorization | Yes | Yes | Yes | Yes |
| CA-7 | Continuous Monitoring | Yes | Yes | Yes | Yes |
| CA-8 | Penetration Testing | Yes | |||
| CA-9 | Internal System Connections | Yes | Yes | Yes |
Withdrawn controls: CA-4.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.