Assessment, Authorization, and Monitoring Policy

Assessment, Authorization, and Monitoring Policy template: Ready-to-adopt Assessment, Authorization, and Monitoring policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Assessment, Authorization, and Monitoring policy states what the organization requires for assessment, authorization, and monitoring and who is accountable for it. It meets CA-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. CA-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
CA-1	Policy and Procedures	Yes	Yes	Yes	Yes
CA-2	Control Assessments	Yes	Yes	Yes	Yes
CA-2(1)	Independent Assessors		Yes	Yes
CA-2(2)	Specialized Assessments			Yes
CA-3	Information Exchange	Yes	Yes	Yes
CA-3(6)	Transfer Authorizations			Yes
CA-5	Plan of Action and Milestones	Yes	Yes	Yes	Yes
CA-6	Authorization	Yes	Yes	Yes	Yes
CA-7	Continuous Monitoring	Yes	Yes	Yes	Yes
CA-7(1)	Independent Assessment		Yes	Yes
CA-7(4)	Risk Monitoring	Yes	Yes	Yes	Yes
CA-8	Penetration Testing			Yes
CA-8(1)	Independent Penetration Testing Agent or Team			Yes
CA-9	Internal System Connections	Yes	Yes	Yes

Decisions to make first

The policy has 31 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who assesses each system’s controls, and how is the assessor kept independent of the system?	CA-2, CA-2(1), CA-7(1)	An internal assessment team that sits outside the system’s development, operation and management chain, or a third-party assessor that the system owner does not contract or direct; the authorizing official confirms the level of independence is enough before the assessment plan is approved.	Authorizing official, with the Chief Information Security Officer
Who is the authorizing official for each system and for the common controls, and when does each authorization end?	CA-6	A senior executive with budget or mission responsibility for the system; the Chief Information Security Officer or Chief Information Officer for common controls. Each authorization has a termination date, usually three years, until the authorizing official moves the system to ongoing authorization.	Senior leader
Where are plans of action and milestones kept, and who reviews items that are past due?	CA-5	One plan of action and milestones per system, in the governance, risk and compliance tool or the POA&M template; the system owner updates it and the Chief Information Security Officer reviews past-due items each month.	Chief Information Security Officer
Which information exchanges need a written agreement, and which kind?	CA-3, CA-9	Every exchange with a system outside the authorization boundary has an interconnection security agreement or information exchange security agreement, or contract terms with the same content for an external service; internal connections are authorized by class of component and recorded in the system security plan.	Authorizing official, with the system owner
Which systems and components get penetration testing, and who does it?	CA-8, CA-8(1), CA-2(2)	Every High system and every internet-facing component, at least annually and after a significant change, by an independent team under rules of engagement the authorizing official approves.	Chief Information Security Officer

Record your values in the Assessment, Authorization, and Monitoring decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: CA pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet CA-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CA-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Assessment, Authorization, and Monitoring, and who is accountable for meeting those requirements. (CA-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CA-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (CA-1a.1(a))
• The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (CA-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (CA-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (CA-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (CA-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CA-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (CA-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (CA-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (CA-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (CA-1a.1(a))

Procedures

The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (CA-1a.2)

Dissemination

• The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated Typical: everyone within its scope, through the policy library. (CA-1a)
• The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated Typical: the people who carry them out, and the system owners. (CA-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Control assessments (CA-2)

Guidance

CA-2 is the formal control assessment: an assessor tests whether each control is implemented correctly, operating as intended and producing the desired outcome. The assessment plan is approved before testing starts, and the assessment report goes to the people who decide on the system’s authorization (CA-6). The assessment procedures are usually the objectives and methods (examine, interview, test) in NIST SP 800-53A Rev. 5 (January 2022, updated by release 5.2.0 in August 2025; current as of September 2026), shown on each control page. After the first authorization, the yearly assessment can reuse results from continuous monitoring (CA-7) that are still current and were obtained with enough independence.

• The Chief Information Security Officer shall select, for each assessment, an assessor or assessment team with the skills and technical knowledge the type of assessment and the system’s technologies call for. (CA-2a)
• The assessor shall develop an assessment plan that names the controls and control enhancements under assessment. (CA-2b.1)
• The assessment plan shall describe the assessment procedures used to determine control effectiveness. (CA-2b.2)
• The assessment plan shall describe the assessment environment, the assessment team, and the assessment roles and responsibilities. (CA-2b.3)
• The System owner shall obtain the review and approval of the assessment plan by the authorizing official or the authorizing official’s designated representative before the assessment begins. (CA-2c)
• The assessor shall assess the controls in the system and its environment of operation before the system’s initial authorization, and Fill in: the frequency at which to assess controls in the system and its environment of operation Typical: annually for a subset of controls set by the system’s continuous monitoring strategy, so every control is assessed at least every three years and within the authorization period after it, to determine whether the controls are implemented correctly, operating as intended and producing the desired outcome with respect to the system’s security and privacy requirements. (CA-2d)
• The assessor shall produce an assessment report that documents the results of the assessment, including whether each control assessed is satisfied or other than satisfied, and the evidence for each result. (CA-2e)
• The assessor shall provide the results of each control assessment to Fill in: individuals or roles to whom control assessment results are to be provided Typical: the authorizing official, the system owner and the Chief Information Security Officer. (CA-2f)
• For a system that processes personally identifiable information, the assessor shall also provide the results of the privacy control assessment to the Senior privacy official. (CA-2f)

Guidance

Common controls are assessed once by the organization that provides them, and each system that inherits them reuses that assessment. Record each “other than satisfied” result in the system’s plan of action and milestones (CA-5), unless the authorizing official accepts the risk (RA-7).

Federal systems

The Federal Information Security Modernization Act requires each agency’s information security program to include periodic testing and evaluation of the effectiveness of its information security policies, procedures and practices, “to be performed with a frequency depending on risk, but no less than annually”, including testing of the management, operational and technical controls of every information system in the agency’s inventory, and using automated tools (44 U.S.C. § 3554(b)(5)). OMB Circular A-130, Appendix I, section 4.c(13) and (14), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls, before a system operates and periodically thereafter, at the frequency the agency’s information security continuous monitoring and privacy continuous monitoring strategies set. As of September 2026.

• The Chief Information Security Officer shall ensure the controls of every system in the agency’s system inventory are tested and evaluated at a frequency that depends on risk, and no less than annually, using automated tools where they apply, as 44 U.S.C. § 3554(b)(5) requires. (CA-2d)
• The Chief Information Security Officer shall ensure the assessment frequency set under CA-2d is consistent with the agency’s information security continuous monitoring and privacy continuous monitoring strategies and its risk tolerance, as OMB Circular A-130, Appendix I, section 4.c(14), requires. (CA-2d)

Independent assessors (CA-2(1))

Guidance

An independent assessor has no actual or perceived conflict of interest with the system: they do not build, run or manage it, do not assess their own work, and do not advocate for the organization they assess. Independence can come from a separate internal team or a third-party assessor, provided the system owner cannot influence the assessor’s work or findings. In a small organization where every possible assessor is in the system owner’s chain, NIST’s CA-2(1) discussion allows an independent team of experts to review and validate the assessment results instead.

• The Chief Information Security Officer shall employ independent assessors or assessment teams to conduct control assessments. (CA-2(1))
• The assessor shall be free of any actual or perceived conflict of interest regarding the development, operation, sustainment or management of the system under assessment. (CA-2(1))
• The authorizing official shall determine the level of assessor independence the system needs, based on its security category and risk, and confirm it before approving the assessment plan. (CA-2(1))

Information exchange (CA-3)

Guidance

CA-3 covers every exchange of information with a system outside the authorization boundary, whether over a dedicated connection, an application programming interface or a file transfer. The information exchange agreement records what is exchanged, how it is protected and who is responsible on each side. NIST SP 800-47 Rev. 1, Managing the Security of Information Exchanges (July 2021, current as of September 2026), describes how to plan, establish, maintain and end exchanges and their agreements. NIST’s CA-3 discussion notes that when both systems have the same authorizing official, no separate agreement is needed: the security and privacy plans describe the interface instead.

• The authorizing official shall approve each exchange of information between the system and another system before the exchange begins. (CA-3a)
• The System owner shall manage each exchange of information between the system and other systems using Select one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement] Typical: interconnection security agreements or information exchange security agreements, and service level agreements or contract terms with the same content for external services. (CA-3a)
• The System owner shall record each exchange and the agreement that approves it in the system security plan. (CA-3a)
• Each exchange agreement shall document the interface characteristics, the security and privacy requirements, the controls and the responsibilities for each system, and the impact level of the information communicated. (CA-3b)
• The System owner shall review and update each exchange agreement Fill in: the frequency at which to review and update agreements Typical: at least annually, and when either system makes a significant change that affects the exchange. (CA-3c)
• The System owner shall end an exchange, and close its agreement, when it is no longer needed or when the other party no longer meets the agreement’s security and privacy requirements. (CA-3a)

Federal systems

OMB Circular A-130, Appendix I, section 4.c(16), requires agencies to obtain approval from the authorizing official for connections from an information system, as defined by its authorization boundary, to other information systems, based on the risk to the agency’s operations and assets, individuals, other organizations and the Nation. Section 4.j(2)(f) requires agreements, such as memoranda of understanding, interconnection security agreements or contracts, for interfaces between agency-owned or operated systems and information systems that contractors or other entities use or operate on behalf of the Federal Government. As of September 2026.

• The authorizing official shall base the approval of each connection to another system on the risk to agency operations and assets, individuals, other organizations and the Nation, as OMB Circular A-130, Appendix I, section 4.c(16), requires. (CA-3a)
• The System owner shall ensure a written agreement is in place for each interface between the system and a system that a contractor or other entity uses or operates on behalf of the agency, as OMB Circular A-130, Appendix I, section 4.j(2)(f), requires. (CA-3a)

Plan of action and milestones (CA-5)

Guidance

The plan of action and milestones (POA&M) records every known weakness until it is fixed or formally accepted. It connects assessments to remediation, and assessors read it closely because it shows whether the organization acts on what it finds. The POA&M template lists the fields. Weaknesses in inherited common controls belong on the POA&M of the organization that provides them.

• The System owner shall develop a plan of action and milestones for the system that documents the planned remediation actions to correct weaknesses or deficiencies noted during control assessments and to reduce or eliminate known vulnerabilities in the system. (CA-5a)
• Each item in the plan of action and milestones shall record the weakness and its source, the responsible person or team, the resources required, the milestones and the scheduled completion date. (CA-5a)
• The System owner shall update the plan of action and milestones Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness, based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. (CA-5b)
• The System owner shall record the reason for each change to a scheduled completion date, and close an item only with evidence that the weakness is corrected. (CA-5b)
• The Chief Information Security Officer shall review items past their scheduled completion date each month, and report them to the authorizing official. (CA-5b)

Guidance

A weakness the organization decides not to fix goes through risk acceptance (RA-7), within the tolerance the risk management strategy sets. Record the acceptance and its review date against the item, so an assessor can trace every finding to either a fix or a decision.

Federal systems

The Federal Information Security Modernization Act requires each agency’s information security program to include “a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency” (44 U.S.C. § 3554(b)(6)). OMB Circular A-130, Appendix I, section 4.c(15), requires agencies to use POA&Ms to record and manage the mitigation and remediation of identified weaknesses and deficiencies not associated with accepted risks, and to make them available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 4.k requires agencies to correct deficiencies identified through assessments, continuous monitoring and audits, and to track and manage their remediation through the POA&M process, with material deficiencies also reported in the annual Federal Managers Financial Integrity Act report. As of September 2026.

• The System owner shall record in the plan of action and milestones each weakness and deficiency not associated with an accepted risk, including those found by OMB reviews and internal or external audits, as OMB Circular A-130, Appendix I, sections 4.c(15) and 4.k, requires. (CA-5a)
• The Chief Information Security Officer shall make plans of action and milestones available to OMB, DHS, the inspector general and the U.S. Government Accountability Office on request, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5b)

Authorization (CA-6)

Guidance

Authorization is a senior official’s decision to accept the risk of operating a system, based on the authorization package: the system security plan, the assessment report and the plan of action and milestones. The authorizing official should have budget or mission responsibility for the system, so the person who accepts the risk also owns its consequences. Ongoing authorization replaces the fixed termination date with decisions made from continuous monitoring results; it needs an initial authorization and a working continuous monitoring program (CA-7) first.

• The Senior leader shall assign a senior official, with budget or mission responsibility for the system, as the authorizing official for the system. (CA-6a)
• The Senior leader shall assign a senior official as the authorizing official for the common controls available for inheritance by organizational systems. (CA-6b)
• The System owner shall ensure that, before the system begins operating, the authorizing official for the system accepts the use of the common controls the system inherits. (CA-6c.1)
• The System owner shall ensure that the authorizing official authorizes the system to operate, based on the authorization package, before the system begins operating. (CA-6c.2)
• The authorizing official’s decision shall be recorded in a signed authorization decision document that states the decision, any terms and conditions, and the authorization termination date or that the system is under ongoing authorization. (CA-6c.2)
• The Chief Information Security Officer shall ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems. (CA-6d)
• The authorizing official shall update the authorization Fill in: frequency at which to update the authorizations Typical: at least every three years and after a significant change, or on the time- or event-driven basis the continuous monitoring strategy sets once the authorizing official moves the system to ongoing authorization. (CA-6e)
• When the authorizing official changes, the new authorizing official shall review the current authorization and either accept the documented risk in a new signed decision or begin a reauthorization. (CA-6e)

Federal systems

OMB Circular A-130, Appendix I, section 4.d(1) to (4), requires agencies to designate senior Federal officials to authorize systems and agency-designated common controls; to complete an initial authorization to operate for each system and all agency-designated common controls, based on an explicit acceptance of risk, before operation; to move systems and common controls to an ongoing authorization process when eligible and with the authorizing official’s formal approval; and to reauthorize them as needed, on a time- or event-driven basis, in line with agency risk tolerance. Section 5.f states that only Federal Government personnel may serve as an authorizing official, and that the agency must consider the Senior Agency Official for Privacy’s input in the authorization decision. Section 5.h sets two conditions for ongoing authorization: an initial authorization to operate, and continuous monitoring programs that monitor all implemented security and privacy controls at the frequencies the strategies set; until the authorizing official formally approves the transition, the system keeps a specific authorization termination date. NIST SP 800-37 Rev. 2 (December 2018, current as of September 2026) describes the authorization tasks. As of September 2026.

• The Senior leader shall assign only Federal Government personnel as authorizing officials, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6a)
• For a system that processes personally identifiable information, the authorizing official shall consider the input and recommendations of the Senior Agency Official for Privacy before making the authorization decision, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6c.2)
• The System owner shall move the system to ongoing authorization only after an initial authorization to operate, with a continuous monitoring program that meets the conditions of OMB Circular A-130, Appendix I, section 5.h, and with the authorizing official’s formal approval. (CA-6e)

Continuous monitoring (CA-7)

Guidance

Continuous monitoring keeps the authorization current between full assessments. The system’s Continuous Monitoring Strategy follows the organization-wide strategy (PM-31) and sets what is measured, how often each control is monitored and assessed, how results are analyzed and acted on, and how often the system’s status is reported. A common approach assigns each control a frequency by how often it changes: vulnerability management monthly, physical security annually. NIST SP 800-137 (September 2011, current as of September 2026) describes information security continuous monitoring.

• The System owner shall develop a system-level continuous monitoring strategy that follows the organization-wide continuous monitoring strategy, and implement continuous monitoring in accordance with it. (CA-7)
• The system-level strategy shall establish the following system-level metrics to be monitored: Fill in: system-level metrics to be monitored Typical: open vulnerabilities by severity and age, configuration compliance rate, plan of action and milestones items past due, and unauthorized components found. (CA-7a)
• The system-level strategy shall establish that control effectiveness is monitored Fill in: frequencies at which to monitor control effectiveness Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data. (CA-7b)
• The system-level strategy shall establish that control effectiveness is assessed at Fill in: frequencies at which to assess control effectiveness Typical: the schedule in the system’s continuous monitoring strategy, assessing a third of the controls each year so every control is assessed at least every three years. (CA-7b)
• The System owner shall ensure ongoing control assessments are carried out in accordance with the continuous monitoring strategy. (CA-7c)
• The System owner shall ensure the system-level and organization-defined metrics are monitored on an ongoing basis in accordance with the continuous monitoring strategy. (CA-7d)
• The System owner shall correlate and analyze the information that control assessments and monitoring produce. (CA-7e)
• The System owner shall take response actions to address the results of that analysis, recording weaknesses in the plan of action and milestones (CA-5) and raising risks above tolerance with the authorizing official. (CA-7f)
• The System owner shall report the security status of the system to Fill in: personnel or roles to whom the security status of the system is reported Typical: the authorizing official and the Chief Information Security Officer, Fill in: frequency at which the security status of the system is reported Typical: at least quarterly. (CA-7g)
• For a system that processes personally identifiable information, the System owner shall report the privacy status of the system to Fill in: personnel or roles to whom the privacy status of the system is reported Typical: the authorizing official and the senior privacy official, Fill in: frequency at which the privacy status of the system is reported Typical: at least quarterly. (CA-7g)
• The System owner shall review and update the system-level strategy when the system changes significantly, when the organization-wide strategy changes, and at least annually. (CA-7)

Guidance

Give the system owner the metrics monthly, even when the authorizing official receives a quarterly report, so action is not left to the formal report. The organization-wide strategy (PM-31) may need each system’s data monthly for its own reports. The frequencies set here should also match the assessment frequency under CA-2d, since the yearly assessment is usually the continuous monitoring assessments of that year.

Federal systems

OMB Circular A-130, Appendix I, section 4.d(5) to (8), requires agencies to develop and maintain an information security continuous monitoring (ISCM) strategy, update it at an organization-defined frequency, ensure all selected and implemented controls are addressed in it and effectively monitored on an ongoing basis, and keep an ISCM program with metrics that give meaningful indications of security status and trend analysis at every risk management tier. Section 4.d(9) adds a privacy continuous monitoring (PCM) strategy; footnote 85 allows the two strategies to be combined into one. Section 5.c says that, after the authorization decision, agencies monitor the controls in each system on an ongoing basis, as described in NIST SP 800-137, including assessing control effectiveness, documenting changes, analyzing their security impact and reporting the system’s security state to designated officials. As of September 2026.

• The System owner shall ensure every control selected and implemented for the system is addressed in the system-level strategy and monitored on an ongoing basis, as OMB Circular A-130, Appendix I, section 4.d(7), requires. (CA-7c)
• The System owner shall ensure the system-level strategy follows the agency’s ISCM strategy and, for a system that processes personally identifiable information, its PCM strategy, or the single strategy that combines them. (CA-7)

Independent assessment (CA-7(1))

Guidance

The independence rules of CA-2(1) apply to ongoing assessments too. Automated monitoring data can come from the system’s own tools, but the people who assess what the data shows should not be the system’s administrators. Common ways to meet it are a continuous monitoring team in the security office or the same third-party assessor that performs the yearly assessment.

• The Chief Information Security Officer shall employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. (CA-7(1))
• The ongoing assessors shall meet the independence the authorizing official set for the system under CA-2(1). (CA-7(1))

Risk monitoring (CA-7(4))

Guidance

Risk monitoring ties continuous monitoring to the risk tolerance in the risk management strategy (PM-9). Effectiveness monitoring asks whether the risk responses work, compliance monitoring asks whether they are in place, and change monitoring looks for changes that could alter the risk. Change monitoring usually draws on configuration change control (CM-3), security impact analyses (CM-4) and the component inventory (CM-8).

• The System owner shall make risk monitoring an integral part of the system’s continuous monitoring strategy, informed by the organization’s risk tolerance. (CA-7(4))
• The strategy shall include effectiveness monitoring, to determine whether the implemented risk response measures remain effective. (CA-7(4)(a))
• The strategy shall include compliance monitoring, to verify that required risk response measures are implemented and that security and privacy requirements are satisfied. (CA-7(4)(b))
• The strategy shall include change monitoring, to identify changes to the system and its environment of operation that may affect security and privacy risk. (CA-7(4)(c))

Internal system connections (CA-9)

Guidance

Internal connections are connections between the system and its own separate components, such as printers or mobile devices, rather than other systems (CA-3). NIST’s CA-9 discussion lets the organization authorize a whole class of components with a common configuration instead of each device, which is the usual approach. Record each authorized class in the system security plan.

• The System owner shall authorize internal connections of Fill in: system components or classes of components requiring internal connections to the system Typical: classes of components that connect to the system from inside its boundary, such as printers, scanners, copiers, sensors, and mobile devices with the approved baseline configuration to the system. (CA-9a)
• The System owner shall document, for each internal connection or class of connection, the interface characteristics, the security and privacy requirements, and the nature of the information communicated, in the system security plan. (CA-9b)
• The System owner shall terminate an internal system connection when Fill in: conditions requiring termination of internal connections Typical: the component is retired or reassigned, fails a compliance check, is involved in an incident, or no longer needs the connection. (CA-9c)
• The System owner shall review Fill in: frequency at which to review the continued need for each internal connection Typical: at least annually the continued need for each internal connection, based on whether it supports the organization’s missions or business functions. (CA-9d)

Review and update

• The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated Typical: annually and following Fill in: events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (CA-1c.1)
• The Fill in: an official to manage the assessment, authorization, and monitoring policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated Typical: annually and following Fill in: events that would require assessment, authorization, and monitoring procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (CA-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CA-1a.1(b))