# Assessment, Authorization, and Monitoring Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ca/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet CA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Assessment, Authorization, and Monitoring, and who is accountable for meeting those requirements. (CA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CA-1a.1(a))
- The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CA-1a.1(a))

## Procedures

The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CA-1a.2)

## Dissemination

- The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CA-1a)
- The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CA-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Control assessments (CA-2)

> **Guidance:** CA-2 is the formal control assessment: an assessor tests whether each control is implemented correctly, operating as intended and producing the desired outcome. The [assessment plan](https://kston83.github.io/nist-guide/templates/plans/security-and-privacy-assessment-plan/) is approved before testing starts, and the [assessment report](https://kston83.github.io/nist-guide/templates/reports/security-and-privacy-assessment-report/) goes to the people who decide on the system's authorization (CA-6). The assessment procedures are usually the objectives and methods (examine, interview, test) in NIST SP 800-53A Rev. 5 ([January 2022](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), updated by release 5.2.0 in August 2025; current as of September 2026), shown on each control page. After the first authorization, the yearly assessment can reuse results from continuous monitoring (CA-7) that are still current and were obtained with enough independence.

- The [Chief Information Security Officer] shall select, for each assessment, an assessor or assessment team with the skills and technical knowledge the type of assessment and the system's technologies call for. (CA-2a)
- The assessor shall develop an assessment plan that names the controls and control enhancements under assessment. (CA-2b.1)
- The assessment plan shall describe the assessment procedures used to determine control effectiveness. (CA-2b.2)
- The assessment plan shall describe the assessment environment, the assessment team, and the assessment roles and responsibilities. (CA-2b.3)
- The [System owner] shall obtain the review and approval of the assessment plan by the authorizing official or the authorizing official's designated representative before the assessment begins. (CA-2c)
- The assessor shall assess the controls in the system and its environment of operation before the system's initial authorization, and [Fill in: the frequency at which to assess controls in the system and its environment of operation. Typical: annually for a subset of controls set by the system's continuous monitoring strategy, so every control is assessed at least every three years and within the authorization period] after it, to determine whether the controls are implemented correctly, operating as intended and producing the desired outcome with respect to the system's security and privacy requirements. (CA-2d)
- The assessor shall produce an assessment report that documents the results of the assessment, including whether each control assessed is satisfied or other than satisfied, and the evidence for each result. (CA-2e)
- The assessor shall provide the results of each control assessment to [Fill in: individuals or roles to whom control assessment results are to be provided. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (CA-2f)
- For a system that processes personally identifiable information, the assessor shall also provide the results of the privacy control assessment to the [Senior privacy official]. (CA-2f)

> **Guidance:** Common controls are assessed once by the organization that provides them, and each system that inherits them reuses that assessment. Record each "other than satisfied" result in the system's plan of action and milestones (CA-5), unless the authorizing official accepts the risk (RA-7).

#### Federal systems

The Federal Information Security Modernization Act requires each agency's information security program to include periodic testing and evaluation of the effectiveness of its information security policies, procedures and practices, "to be performed with a frequency depending on risk, but no less than annually", including testing of the management, operational and technical controls of every information system in the agency's inventory, and using automated tools ([44 U.S.C. § 3554(b)(5)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(13) and (14), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls, before a system operates and periodically thereafter, at the frequency the agency's information security continuous monitoring and privacy continuous monitoring strategies set. As of September 2026.

- The [Chief Information Security Officer] shall ensure the controls of every system in the agency's system inventory are tested and evaluated at a frequency that depends on risk, and no less than annually, using automated tools where they apply, as 44 U.S.C. § 3554(b)(5) requires. (CA-2d)
- The [Chief Information Security Officer] shall ensure the assessment frequency set under CA-2d is consistent with the agency's information security continuous monitoring and privacy continuous monitoring strategies and its risk tolerance, as OMB Circular A-130, Appendix I, section 4.c(14), requires. (CA-2d)

### Independent assessors (CA-2(1))

> **Guidance:** An independent assessor has no actual or perceived conflict of interest with the system: they do not build, run or manage it, do not assess their own work, and do not advocate for the organization they assess. Independence can come from a separate internal team or a third-party assessor, provided the system owner cannot influence the assessor's work or findings. In a small organization where every possible assessor is in the system owner's chain, NIST's CA-2(1) discussion allows an independent team of experts to review and validate the assessment results instead.

- The [Chief Information Security Officer] shall employ independent assessors or assessment teams to conduct control assessments. (CA-2(1))
- The assessor shall be free of any actual or perceived conflict of interest regarding the development, operation, sustainment or management of the system under assessment. (CA-2(1))
- The authorizing official shall determine the level of assessor independence the system needs, based on its security category and risk, and confirm it before approving the assessment plan. (CA-2(1))

### Specialized assessments (CA-2(2))

> **Guidance:** Specialized assessments go beyond the standard examine, interview and test methods to exercise the organization's defenses as an adversary or insider would. NIST's CA-2(2) discussion has the authorizing official approve the methods, in coordination with the organization's risk executive function. Unannounced assessments test detection and response more realistically but need tighter rules of engagement, so organizations often start with announced ones.

- The assessor shall include [Select one: announced; unannounced. Typical: announced] [Select one or more: in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]. Typical: vulnerability scanning, malicious user testing, insider threat assessment, and data leakage or data loss assessment] as part of control assessments, [Fill in: frequency at which to include specialized assessments as part of the control assessment. Typical: at least annually]. (CA-2(2))
- The authorizing official shall approve the specialized assessment methods, and their rules of engagement, before they are used. (CA-2(2))
- The [System owner] shall enter each vulnerability that a specialized assessment finds into the system's vulnerability remediation process (RA-5). (CA-2(2))

### Information exchange (CA-3)

> **Guidance:** CA-3 covers every exchange of information with a system outside the authorization boundary, whether over a dedicated connection, an application programming interface or a file transfer. The [information exchange agreement](https://kston83.github.io/nist-guide/templates/forms/information-exchange-agreement/) records what is exchanged, how it is protected and who is responsible on each side. NIST SP 800-47 Rev. 1, Managing the Security of Information Exchanges ([July 2021](https://csrc.nist.gov/pubs/sp/800/47/r1/final), current as of September 2026), describes how to plan, establish, maintain and end exchanges and their agreements. NIST's CA-3 discussion notes that when both systems have the same authorizing official, no separate agreement is needed: the security and privacy plans describe the interface instead.

- The authorizing official shall approve each exchange of information between the system and another system before the exchange begins. (CA-3a)
- The [System owner] shall manage each exchange of information between the system and other systems using [Select one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement]. Typical: interconnection security agreements or information exchange security agreements, and service level agreements or contract terms with the same content for external services]. (CA-3a)
- The [System owner] shall record each exchange and the agreement that approves it in the system security plan. (CA-3a)
- Each exchange agreement shall document the interface characteristics, the security and privacy requirements, the controls and the responsibilities for each system, and the impact level of the information communicated. (CA-3b)
- The [System owner] shall review and update each exchange agreement [Fill in: the frequency at which to review and update agreements. Typical: at least annually, and when either system makes a significant change that affects the exchange]. (CA-3c)
- The [System owner] shall end an exchange, and close its agreement, when it is no longer needed or when the other party no longer meets the agreement's security and privacy requirements. (CA-3a)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(16), requires agencies to obtain approval from the authorizing official for connections from an information system, as defined by its authorization boundary, to other information systems, based on the risk to the agency's operations and assets, individuals, other organizations and the Nation. Section 4.j(2)(f) requires agreements, such as memoranda of understanding, interconnection security agreements or contracts, for interfaces between agency-owned or operated systems and information systems that contractors or other entities use or operate on behalf of the Federal Government. As of September 2026.

- The authorizing official shall base the approval of each connection to another system on the risk to agency operations and assets, individuals, other organizations and the Nation, as OMB Circular A-130, Appendix I, section 4.c(16), requires. (CA-3a)
- The [System owner] shall ensure a written agreement is in place for each interface between the system and a system that a contractor or other entity uses or operates on behalf of the agency, as OMB Circular A-130, Appendix I, section 4.j(2)(f), requires. (CA-3a)

### Transfer authorizations (CA-3(6))

> **Guidance:** Transfer authorization checks the sender, not only the connection: before the system accepts data from an interconnected system, it confirms that the person or system sending it is permitted to write that data. Service accounts used for transfers are the usual gap; give each one only the write permissions its exchange agreement names.

- The [System owner] shall ensure the system verifies that individuals or systems transferring data between interconnecting systems have the requisite authorizations, such as write permissions or privileges, before it accepts the data. (CA-3(6))
- Each exchange agreement shall name the accounts or systems authorized to transfer data under it and the permissions each holds. (CA-3(6))

### Plan of action and milestones (CA-5)

> **Guidance:** The plan of action and milestones (POA&M) records every known weakness until it is fixed or formally accepted. It connects assessments to remediation, and assessors read it closely because it shows whether the organization acts on what it finds. The [POA&M template](https://kston83.github.io/nist-guide/templates/forms/plan-of-action-and-milestones/) lists the fields. Weaknesses in inherited common controls belong on the POA&M of the organization that provides them.

- The [System owner] shall develop a plan of action and milestones for the system that documents the planned remediation actions to correct weaknesses or deficiencies noted during control assessments and to reduce or eliminate known vulnerabilities in the system. (CA-5a)
- Each item in the plan of action and milestones shall record the weakness and its source, the responsible person or team, the resources required, the milestones and the scheduled completion date. (CA-5a)
- The [System owner] shall update the plan of action and milestones [Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness], based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. (CA-5b)
- The [System owner] shall record the reason for each change to a scheduled completion date, and close an item only with evidence that the weakness is corrected. (CA-5b)
- The [Chief Information Security Officer] shall review items past their scheduled completion date each month, and report them to the authorizing official. (CA-5b)

> **Guidance:** A weakness the organization decides not to fix goes through risk acceptance (RA-7), within the tolerance the risk management strategy sets. Record the acceptance and its review date against the item, so an assessor can trace every finding to either a fix or a decision.

#### Federal systems

The Federal Information Security Modernization Act requires each agency's information security program to include "a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency" ([44 U.S.C. § 3554(b)(6)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(15), requires agencies to use POA&Ms to record and manage the mitigation and remediation of identified weaknesses and deficiencies not associated with accepted risks, and to make them available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 4.k requires agencies to correct deficiencies identified through assessments, continuous monitoring and audits, and to track and manage their remediation through the POA&M process, with material deficiencies also reported in the annual Federal Managers Financial Integrity Act report. As of September 2026.

- The [System owner] shall record in the plan of action and milestones each weakness and deficiency not associated with an accepted risk, including those found by OMB reviews and internal or external audits, as OMB Circular A-130, Appendix I, sections 4.c(15) and 4.k, requires. (CA-5a)
- The [Chief Information Security Officer] shall make plans of action and milestones available to OMB, DHS, the inspector general and the U.S. Government Accountability Office on request, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5b)

### Authorization (CA-6)

> **Guidance:** Authorization is a senior official's decision to accept the risk of operating a system, based on the authorization package: the system security plan, the [assessment report](https://kston83.github.io/nist-guide/templates/reports/security-and-privacy-assessment-report/) and the plan of action and milestones. The authorizing official should have budget or mission responsibility for the system, so the person who accepts the risk also owns its consequences. Ongoing authorization replaces the fixed termination date with decisions made from continuous monitoring results; it needs an initial authorization and a working continuous monitoring program (CA-7) first.

- The [Senior leader] shall assign a senior official, with budget or mission responsibility for the system, as the authorizing official for the system. (CA-6a)
- The [Senior leader] shall assign a senior official as the authorizing official for the common controls available for inheritance by organizational systems. (CA-6b)
- The [System owner] shall ensure that, before the system begins operating, the authorizing official for the system accepts the use of the common controls the system inherits. (CA-6c.1)
- The [System owner] shall ensure that the authorizing official authorizes the system to operate, based on the authorization package, before the system begins operating. (CA-6c.2)
- The authorizing official's decision shall be recorded in a signed authorization decision document that states the decision, any terms and conditions, and the authorization termination date or that the system is under ongoing authorization. (CA-6c.2)
- The [Chief Information Security Officer] shall ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems. (CA-6d)
- The authorizing official shall update the authorization [Fill in: frequency at which to update the authorizations. Typical: at least every three years and after a significant change, or on the time- or event-driven basis the continuous monitoring strategy sets once the authorizing official moves the system to ongoing authorization]. (CA-6e)
- When the authorizing official changes, the new authorizing official shall review the current authorization and either accept the documented risk in a new signed decision or begin a reauthorization. (CA-6e)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.d(1) to (4), requires agencies to designate senior Federal officials to authorize systems and agency-designated common controls; to complete an initial authorization to operate for each system and all agency-designated common controls, based on an explicit acceptance of risk, before operation; to move systems and common controls to an ongoing authorization process when eligible and with the authorizing official's formal approval; and to reauthorize them as needed, on a time- or event-driven basis, in line with agency risk tolerance. Section 5.f states that only Federal Government personnel may serve as an authorizing official, and that the agency must consider the Senior Agency Official for Privacy's input in the authorization decision. Section 5.h sets two conditions for ongoing authorization: an initial authorization to operate, and continuous monitoring programs that monitor all implemented security and privacy controls at the frequencies the strategies set; until the authorizing official formally approves the transition, the system keeps a specific authorization termination date. NIST SP 800-37 Rev. 2 ([December 2018](https://csrc.nist.gov/pubs/sp/800/37/r2/final), current as of September 2026) describes the authorization tasks. As of September 2026.

- The [Senior leader] shall assign only Federal Government personnel as authorizing officials, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6a)
- For a system that processes personally identifiable information, the authorizing official shall consider the input and recommendations of the Senior Agency Official for Privacy before making the authorization decision, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6c.2)
- The [System owner] shall move the system to ongoing authorization only after an initial authorization to operate, with a continuous monitoring program that meets the conditions of OMB Circular A-130, Appendix I, section 5.h, and with the authorizing official's formal approval. (CA-6e)

### Continuous monitoring (CA-7)

> **Guidance:** Continuous monitoring keeps the authorization current between full assessments. The system's [Continuous Monitoring Strategy](https://kston83.github.io/nist-guide/templates/plans/continuous-monitoring-strategy/) follows the organization-wide strategy (PM-31) and sets what is measured, how often each control is monitored and assessed, how results are analyzed and acted on, and how often the system's status is reported. A common approach assigns each control a frequency by how often it changes: vulnerability management monthly, physical security annually. NIST SP 800-137 ([September 2011](https://csrc.nist.gov/pubs/sp/800/137/final), current as of September 2026) describes information security continuous monitoring.

- The [System owner] shall develop a system-level continuous monitoring strategy that follows the organization-wide continuous monitoring strategy, and implement continuous monitoring in accordance with it. (CA-7)
- The system-level strategy shall establish the following system-level metrics to be monitored: [Fill in: system-level metrics to be monitored. Typical: open vulnerabilities by severity and age, configuration compliance rate, plan of action and milestones items past due, and unauthorized components found]. (CA-7a)
- The system-level strategy shall establish that control effectiveness is monitored [Fill in: frequencies at which to monitor control effectiveness. Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data]. (CA-7b)
- The system-level strategy shall establish that control effectiveness is assessed at [Fill in: frequencies at which to assess control effectiveness. Typical: the schedule in the system's continuous monitoring strategy, assessing a third of the controls each year so every control is assessed at least every three years]. (CA-7b)
- The [System owner] shall ensure ongoing control assessments are carried out in accordance with the continuous monitoring strategy. (CA-7c)
- The [System owner] shall ensure the system-level and organization-defined metrics are monitored on an ongoing basis in accordance with the continuous monitoring strategy. (CA-7d)
- The [System owner] shall correlate and analyze the information that control assessments and monitoring produce. (CA-7e)
- The [System owner] shall take response actions to address the results of that analysis, recording weaknesses in the plan of action and milestones (CA-5) and raising risks above tolerance with the authorizing official. (CA-7f)
- The [System owner] shall report the security status of the system to [Fill in: personnel or roles to whom the security status of the system is reported. Typical: the authorizing official and the Chief Information Security Officer], [Fill in: frequency at which the security status of the system is reported. Typical: at least quarterly]. (CA-7g)
- For a system that processes personally identifiable information, the [System owner] shall report the privacy status of the system to [Fill in: personnel or roles to whom the privacy status of the system is reported. Typical: the authorizing official and the senior privacy official], [Fill in: frequency at which the privacy status of the system is reported. Typical: at least quarterly]. (CA-7g)
- The [System owner] shall review and update the system-level strategy when the system changes significantly, when the organization-wide strategy changes, and at least annually. (CA-7)

> **Guidance:** Give the system owner the metrics monthly, even when the authorizing official receives a quarterly report, so action is not left to the formal report. The organization-wide strategy (PM-31) may need each system's data monthly for its own reports. The frequencies set here should also match the assessment frequency under CA-2d, since the yearly assessment is usually the continuous monitoring assessments of that year.

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.d(5) to (8), requires agencies to develop and maintain an information security continuous monitoring (ISCM) strategy, update it at an organization-defined frequency, ensure all selected and implemented controls are addressed in it and effectively monitored on an ongoing basis, and keep an ISCM program with metrics that give meaningful indications of security status and trend analysis at every risk management tier. Section 4.d(9) adds a privacy continuous monitoring (PCM) strategy; footnote 85 allows the two strategies to be combined into one. Section 5.c says that, after the authorization decision, agencies monitor the controls in each system on an ongoing basis, as described in NIST SP 800-137, including assessing control effectiveness, documenting changes, analyzing their security impact and reporting the system's security state to designated officials. As of September 2026.

- The [System owner] shall ensure every control selected and implemented for the system is addressed in the system-level strategy and monitored on an ongoing basis, as OMB Circular A-130, Appendix I, section 4.d(7), requires. (CA-7c)
- The [System owner] shall ensure the system-level strategy follows the agency's ISCM strategy and, for a system that processes personally identifiable information, its PCM strategy, or the single strategy that combines them. (CA-7)

### Independent assessment (CA-7(1))

> **Guidance:** The independence rules of CA-2(1) apply to ongoing assessments too. Automated monitoring data can come from the system's own tools, but the people who assess what the data shows should not be the system's administrators. Common ways to meet it are a continuous monitoring team in the security office or the same third-party assessor that performs the yearly assessment.

- The [Chief Information Security Officer] shall employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. (CA-7(1))
- The ongoing assessors shall meet the independence the authorizing official set for the system under CA-2(1). (CA-7(1))

### Risk monitoring (CA-7(4))

> **Guidance:** Risk monitoring ties continuous monitoring to the risk tolerance in the risk management strategy (PM-9). Effectiveness monitoring asks whether the risk responses work, compliance monitoring asks whether they are in place, and change monitoring looks for changes that could alter the risk. Change monitoring usually draws on configuration change control (CM-3), security impact analyses (CM-4) and the component inventory (CM-8).

- The [System owner] shall make risk monitoring an integral part of the system's continuous monitoring strategy, informed by the organization's risk tolerance. (CA-7(4))
- The strategy shall include effectiveness monitoring, to determine whether the implemented risk response measures remain effective. (CA-7(4)(a))
- The strategy shall include compliance monitoring, to verify that required risk response measures are implemented and that security and privacy requirements are satisfied. (CA-7(4)(b))
- The strategy shall include change monitoring, to identify changes to the system and its environment of operation that may affect security and privacy risk. (CA-7(4)(c))

### Penetration testing (CA-8)

> **Guidance:** Penetration testing goes beyond automated vulnerability scanning: skilled testers try to exploit weaknesses the way an adversary would, within agreed limits of time, scope and method. Written rules of engagement, approved before testing, set the scope, times, methods allowed, contacts and how a test is stopped. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment ([September 2008](https://csrc.nist.gov/pubs/sp/800/115/final), current as of September 2026), describes planning and running penetration tests.

- The [Chief Information Security Officer] shall conduct penetration testing [Fill in: frequency at which to conduct penetration testing on systems or system components. Typical: at least annually, and after a significant change to the system] on [Fill in: systems or system components on which penetration testing is to be conducted. Typical: the system's internet-facing components and applications, and a sample of its internal components]. (CA-8)
- The authorizing official shall approve written rules of engagement, covering scope, timing, methods, contacts and how testing is stopped, before each penetration test begins. (CA-8)
- The [System owner] shall enter each weakness a penetration test finds into the system's plan of action and milestones or vulnerability remediation process. (CA-8)

### Independent penetration testing agent or team (CA-8(1))

> **Guidance:** An independent penetration testing team is one with no conflict of interest in the system, as for independent assessors under CA-2(1). It can be an internal red team outside the system's chain of command or an outside firm.

- The [Chief Information Security Officer] shall employ an independent penetration testing agent or team to perform penetration testing on the system or system components. (CA-8(1))

### Internal system connections (CA-9)

> **Guidance:** Internal connections are connections between the system and its own separate components, such as printers or mobile devices, rather than other systems (CA-3). NIST's CA-9 discussion lets the organization authorize a whole class of components with a common configuration instead of each device, which is the usual approach. Record each authorized class in the system security plan.

- The [System owner] shall authorize internal connections of [Fill in: system components or classes of components requiring internal connections to the system. Typical: classes of components that connect to the system from inside its boundary, such as printers, scanners, copiers, sensors, and mobile devices with the approved baseline configuration] to the system. (CA-9a)
- The [System owner] shall document, for each internal connection or class of connection, the interface characteristics, the security and privacy requirements, and the nature of the information communicated, in the system security plan. (CA-9b)
- The [System owner] shall terminate an internal system connection when [Fill in: conditions requiring termination of internal connections. Typical: the component is retired or reassigned, fails a compliance check, is involved in an incident, or no longer needs the connection]. (CA-9c)
- The [System owner] shall review [Fill in: frequency at which to review the continued need for each internal connection. Typical: at least annually] the continued need for each internal connection, based on whether it supports the organization's missions or business functions. (CA-9d)

## Review and update

- The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CA-1c.1)
- The [Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require assessment, authorization, and monitoring procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CA-1a.1(b))