CA-2 Control Assessments

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High, Privacy	Organization	3 (2 in a baseline)

Related controls: AC-20, CA-5, CA-6, CA-7, PM-9, RA-5, RA-10, SA-11, SC-38, SI-3, SI-12, SR-2, SR-3

Control statement

• a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
• b. Develop a control assessment plan that describes the scope of the assessment including:
  • 1. Controls and control enhancements under assessment;
  • 2. Assessment procedures to be used to determine control effectiveness; and
  • 3. Assessment environment, assessment team, and assessment roles and responsibilities;
• c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• d. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
• e. Produce a control assessment report that document the results of the assessment; and
• f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].

NIST discussion

Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented.

Organizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes.

Organizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs.

Organizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives.

To satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of CA-2.

Control enhancements

CA-2(1) Independent Assessors

Baselines: Moderate, High

Employ independent assessors or assessment teams to conduct control assessments.

Discussion and assessment objectives for CA-2(1)

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of systems. Impartiality means that assessors are free from any perceived or actual conflicts of interest regarding the development, operation, sustainment, or management of the systems under assessment or the determination of control effectiveness. To achieve impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in positions of advocacy for the organizations acquiring their services.

Independent assessments can be obtained from elements within organizations or be contracted to public or private sector entities outside of organizations. Authorizing officials determine the required level of independence based on the security categories of systems and/or the risk to organizational operations, organizational assets, or individuals. Authorizing officials also determine if the level of assessor independence provides sufficient assurance that the results are sound and can be used to make credible, risk-based decisions. Assessor independence determination includes whether contracted assessment services have sufficient independence, such as when system owners are not directly involved in contracting processes or cannot influence the impartiality of the assessors conducting the assessments. During the system design and development phase, having independent assessors is analogous to having independent SMEs involved in design reviews.

When organizations that own the systems are small or the structures of the organizations require that assessments be conducted by individuals that are in the developmental, operational, or management chain of the system owners, independence in assessment processes can be achieved by ensuring that assessment results are carefully reviewed and analyzed by independent teams of experts to validate the completeness, accuracy, integrity, and reliability of the results. Assessments performed for purposes other than to support authorization decisions are more likely to be useable for such decisions when performed by assessors with sufficient independence, thereby reducing the need to repeat assessments.

Determine if independent assessors or assessment teams are employed to conduct control assessments.

Examine: Assessment, authorization, and monitoring policy; procedures addressing control assessments; previous control assessment plan; previous control assessment report; plan of action and milestones; existing authorization statement; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with security assessment responsibilities; organizational personnel with information security and privacy responsibilities.

CA-2(2) Specialized Assessments

Baselines: High

Include as part of control assessments, [Assignment: organization-defined specialized assessment frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment] ].

Discussion and assessment objectives for CA-2(2)

Organizations can conduct specialized assessments, including verification and validation, system monitoring, insider threat assessments, malicious user testing, and other forms of testing. These assessments can improve readiness by exercising organizational capabilities and indicating current levels of performance as a means of focusing actions to improve security and privacy. Organizations conduct specialized assessments in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Authorizing officials approve the assessment methods in coordination with the organizational risk executive function. Organizations can include vulnerabilities uncovered during assessments into vulnerability remediation processes. Specialized assessments can also be conducted early in the system development life cycle (e.g., during initial design, development, and unit testing).

Determine if [Assignment: organization-defined specialized assessment frequency] [Selection: announced; unannounced] [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment] ] are included as part of control assessments.

Examine: Assessment, authorization, and monitoring policy; procedures addressing control assessments; control assessment plan; control assessment report; control assessment evidence; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with control assessment responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Mechanisms supporting control assessment.

CA-2(3) Leveraging Results from External Organizations

Baselines: Not in a baseline

Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].

Discussion and assessment objectives for CA-2(3)

Organizations may rely on control assessments of organizational systems by other (external) organizations. Using such assessments and reusing existing assessment evidence can decrease the time and resources required for assessments by limiting the independent assessment activities that organizations need to perform. The factors that organizations consider in determining whether to accept assessment results from external organizations can vary. Such factors include the organization’s past experience with the organization that conducted the assessment, the reputation of the assessment organization, the level of detail of supporting assessment evidence provided, and mandates imposed by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Accredited testing laboratories that support the Common Criteria Program ISO 15408-1 , the NIST Cryptographic Module Validation Program (CMVP), or the NIST Cryptographic Algorithm Validation Program (CAVP) can provide independent assessment results that organizations can leverage.

Determine if the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] are leveraged when the assessment meets [Assignment: organization-defined requirements].

Examine: Assessment, authorization, and monitoring policy; procedures addressing control assessments; control assessment requirements; control assessment plan; control assessment report; control assessment evidence; plan of action and milestones; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with control assessment responsibilities; organizational personnel with information security and privacy responsibilities; personnel performing control assessments for the specified external organization.

Assessment objectives (SP 800-53A)

Objectives and methods for CA-2

Determine if:

• CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
• CA-02b.
  • CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
  • CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
  • CA-02b.03
    • CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
    • CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
    • CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
• CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• CA-02d.
  • CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
  • CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
• CA-02e. a control assessment report is produced that documents the results of the assessment;
• CA-02f. the results of the control assessment are provided to [Assignment: organization-defined individuals or roles].

Examine: Assessment, authorization, and monitoring policy; procedures addressing assessment planning; procedures addressing control assessments; control assessment plan; control assessment report; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with control assessment responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting.

Policy statement

• The Chief Information Security Officer shall select, for each assessment, an assessor or assessment team with the skills and technical knowledge the type of assessment and the system’s technologies call for. (CA-2a)
• The assessor shall develop an assessment plan that names the controls and control enhancements under assessment. (CA-2b.1)
• The assessment plan shall describe the assessment procedures used to determine control effectiveness. (CA-2b.2)
• The assessment plan shall describe the assessment environment, the assessment team, and the assessment roles and responsibilities. (CA-2b.3)
• The System owner shall obtain the review and approval of the assessment plan by the authorizing official or the authorizing official’s designated representative before the assessment begins. (CA-2c)
• The assessor shall assess the controls in the system and its environment of operation before the system’s initial authorization, and Fill in: the frequency at which to assess controls in the system and its environment of operation Typical: annually for a subset of controls set by the system’s continuous monitoring strategy, so every control is assessed at least every three years and within the authorization period after it, to determine whether the controls are implemented correctly, operating as intended and producing the desired outcome with respect to the system’s security and privacy requirements. (CA-2d)
• The assessor shall produce an assessment report that documents the results of the assessment, including whether each control assessed is satisfied or other than satisfied, and the evidence for each result. (CA-2e)
• The assessor shall provide the results of each control assessment to Fill in: individuals or roles to whom control assessment results are to be provided Typical: the authorizing official, the system owner and the Chief Information Security Officer. (CA-2f)
• For a system that processes personally identifiable information, the assessor shall also provide the results of the privacy control assessment to the Senior privacy official. (CA-2f)

Federal systems

The Federal Information Security Modernization Act requires each agency’s information security program to include periodic testing and evaluation of the effectiveness of its information security policies, procedures and practices, “to be performed with a frequency depending on risk, but no less than annually”, including testing of the management, operational and technical controls of every information system in the agency’s inventory, and using automated tools (44 U.S.C. § 3554(b)(5)). OMB Circular A-130, Appendix I, section 4.c(13) and (14), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls, before a system operates and periodically thereafter, at the frequency the agency’s information security continuous monitoring and privacy continuous monitoring strategies set. As of September 2026.

• The Chief Information Security Officer shall ensure the controls of every system in the agency’s system inventory are tested and evaluated at a frequency that depends on risk, and no less than annually, using automated tools where they apply, as 44 U.S.C. § 3554(b)(5) requires. (CA-2d)
• The Chief Information Security Officer shall ensure the assessment frequency set under CA-2d is consistent with the agency’s information security continuous monitoring and privacy continuous monitoring strategies and its risk tolerance, as OMB Circular A-130, Appendix I, section 4.c(14), requires. (CA-2d)

CA-2(1) Independent assessors

• The Chief Information Security Officer shall employ independent assessors or assessment teams to conduct control assessments. (CA-2(1))
• The assessor shall be free of any actual or perceived conflict of interest regarding the development, operation, sustainment or management of the system under assessment. (CA-2(1))
• The authorizing official shall determine the level of assessor independence the system needs, based on its security category and risk, and confirm it before approving the assessment plan. (CA-2(1))

CA-2(2) Specialized assessments

• The assessor shall include Select one: announced; unannounced Typical: announced Select one or more: in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment] Typical: vulnerability scanning, malicious user testing, insider threat assessment, and data leakage or data loss assessment as part of control assessments, Fill in: frequency at which to include specialized assessments as part of the control assessment Typical: at least annually. (CA-2(2))
• The authorizing official shall approve the specialized assessment methods, and their rules of engagement, before they are used. (CA-2(2))
• The System owner shall enter each vulnerability that a specialized assessment finds into the system’s vulnerability remediation process (RA-5). (CA-2(2))

From the Assessment, Authorization, and Monitoring Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

CA-2 is the formal control assessment: an assessor, independent at Moderate (CA-2(1)), tests whether each control is implemented correctly, operating as intended and producing the desired outcome. The assessment plan is approved before testing starts, and the report goes to the people who decide on the system’s authorization.

Common implementations. An assessment before initial authorization, then an annual assessment of a subset of controls under the continuous monitoring strategy (CA-7), so every control is assessed over the authorization period. Assessments follow the objectives and methods in SP 800-53A, shown on each control page. Independence comes from a separate internal team or a third-party assessor. The Security and Privacy Assessment Plan and Security and Privacy Assessment Report templates follow SP 800-53A.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Assessment frequency (d)	Annually for a subset of controls, set by the continuous monitoring strategy, so all controls are assessed within the authorization period
Who receives results (f)	The authorizing official, the system owner and the Chief Information Security Officer

Evidence assessors ask for. Assessors produce CA-2 evidence rather than request it: the approved assessment plan, the assessment report, and proof the report reached the named recipients.

Inheritance. The assessment of common controls is done once by their provider and reused; the system assessment covers system-specific and hybrid controls.

Common findings.

• Assessment plans approved after testing started.
• Assessors who also operate the system they assess.
• Reports that list findings without recording them in the POA&M (CA-5).

Enhancements in the Moderate baseline. CA-2(1) independent assessors. High adds CA-2(2) specialized assessments.

Artifacts

• Assessment, Authorization, and Monitoring Decision Worksheet
• Assessment, Authorization, and Monitoring Policy
• Continuous Monitoring Strategy
• Security and Privacy Assessment Plan
• Security and Privacy Assessment Report