# Security and Privacy Assessment Report
**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
| System name | System identifier | Security categorization | Assessment dates | Report version | Lead assessor |
| --- | --- | --- | --- | --- | --- |
| [Fill in: system name, or the common controls assessed] | [Fill in: unique system identifier] | [Fill in: low, moderate or high] | [Fill in: first and last day] | [Fill in: draft or final, with version] | [Fill in: name and organization] |
## 1. Executive summary
- **Assessment:** [Fill in: the reason for the assessment, for example initial authorization, and whether it was complete or partial]
- **Results:** [Fill in: the number of controls assessed, the number satisfied, and the number other than satisfied]
- **Most significant weaknesses:** [Fill in: the weaknesses that matter most to the authorizing official, one or two sentences each]
- **Assessor's recommendations:** [Fill in: the priorities for correction, in order]
## 2. Assessment information
| Item | Description |
| --- | --- |
| Assessment plan | [Fill in: plan version and the date the authorizing official or designated representative approved it] |
| Sites assessed and dates | [Fill in: sites, environments and dates] |
| Assessors and independence | [Fill in: names, organizations, and the independence the authorizing official required (CA-2(1))] |
| Changes from the plan | [Fill in: controls, methods or dates that changed, and why, or "none"] |
| Previous results reused | [Fill in: the controls, the earlier assessment and its date, or "none"] |
| Inherited common controls | [Fill in: the provider assessments relied on, with their dates] |
| Limitations | [Fill in: anything the assessors could not see or test, and its effect on the findings] |
## 3. Summary of results
Every control and control enhancement assessed, with its overall status (CA-2e):
| Control or enhancement | Implementation (system-specific, hybrid or inherited) | Methods used | Overall result | Finding IDs |
| --- | --- | --- | --- | --- |
| [Fill in: for example AC-2] | [Fill in: implementation] | [Fill in: examine, interview, test] | [Fill in: satisfied or other than satisfied] | [Fill in: IDs from section 4, or "none"] |
## 4. Findings
Each determination statement in the assessment procedures produced a finding of "satisfied" or "other than satisfied". A statement the assessors could not determine, for example because evidence was not provided or a parameter is not defined, is recorded as other than satisfied, with the reason.
| Finding ID | Control and determination statement | Methods and objects | Depth and coverage | Result | Assessor comments | Potential impact | Recommendation | Severity |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: for example AC-02d.01] | [Fill in: what was examined, who was interviewed, what was tested] | [Fill in: for example focused, focused] | [Fill in: satisfied or other than satisfied] | [Fill in: for other than satisfied: which part of the control is affected, and how the actual state differs from the expected state] | [Fill in: the potential for compromise of confidentiality, integrity or availability, or the privacy risk] | [Fill in: the recommended correction or improvement] | [Fill in: the organization's severity scale, if it defines one] |
## 5. Privacy control results
[Fill in: for a system that processes personally identifiable information, the privacy control results and the privacy risks they indicate, or a reference to a separate privacy assessment report; otherwise "the system does not process personally identifiable information"]
## 6. Weaknesses corrected before the final report
The [System owner] reviewed the draft report and corrected the weaknesses below. The assessors reassessed each control before issuing this final report.
| Finding ID | Correction made | Date reassessed | Result after reassessment |
| --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: correction] | [Fill in: date] | [Fill in: satisfied or other than satisfied] |
## 7. From findings to action
- The [System owner] shall enter each weakness found in this assessment, and not corrected under section 6, in the system's [plan of action and milestones](https://kston83.github.io/nist-guide/templates/forms/plan-of-action-and-milestones/), unless the authorizing official accepts the risk (RA-7). (CA-5a)
- The [System owner] shall update the plan of action and milestones [Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness], including the items this report adds. (CA-5b)
- The [System owner] shall include this report in the authorization package, with the security and privacy plans, the plan of action and milestones and an executive summary, for the authorizing official's decision. (CA-6c.2)
- The [System owner] shall update the security and privacy plans where the assessment showed that the implementation differs from what they describe. (CA-2)
| Finding ID | Plan of action and milestones item, or risk acceptance reference |
| --- | --- |
| [Fill in: ID] | [Fill in: item ID or acceptance reference and date] |
## 8. Distribution
The results of this assessment are provided to [Fill in: individuals or roles to whom control assessment results are to be provided. Typical: the authorizing official, the system owner and the Chief Information Security Officer] (CA-2f). For a system that processes personally identifiable information, the privacy control results are also provided to the [Senior privacy official] (CA-2f). This report describes the system's weaknesses: it is marked [Fill in: the organization's handling marking] and shared only with these recipients and the people they designate.
| Recipient | Date provided |
| --- | --- |
| [Fill in: name and title] | [Fill in: date] |
### Federal systems
[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(13), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls. Section 4.c(15) requires plans of action and milestones for weaknesses and deficiencies not associated with accepted risks, available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 5.f requires the agency to consider the Senior Agency Official for Privacy's input in the authorization decision. As of September 2026.
- The [System owner] shall record in the plan of action and milestones each weakness in this report that is not associated with an accepted risk, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5a)
- For a system that processes personally identifiable information, the lead assessor shall provide the privacy control results to the Senior Agency Official for Privacy in time to inform the authorization decision, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-2f)
## 9. Assessor signature
The findings in this report are an impartial record of what the assessors found.
| Name | Role | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | Lead assessor | | [Fill in: date] |
## Appendix A. Evidence and sources
[Fill in: the documents examined, the people interviewed by role, and the tests run with tool names and versions, or where the assessment records are kept]
## Appendix B. Scan and test results
[Fill in: the vulnerability and configuration scan results and any penetration test report, or where they are kept]