Security and Privacy Assessment Report

Security and Privacy Assessment Report template: The results of one control assessment, with a finding of satisfied or other than satisfied for each control and the evidence behind it, following the key elements in SP 800-53A Rev. 5 Appendix E; its findings feed the POA&M (CA-5) and the authorization package (CA-6).

Type	Program stage	Status	Template version	NIST basis
Report	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The results of one control assessment, with a finding of satisfied or other than satisfied for each control and the evidence behind it, following the key elements in SP 800-53A Rev. 5 Appendix E; its findings feed the POA&M (CA-5) and the authorization package (CA-6).

Controls satisfied

Control	Title
CA-2	Control Assessments
CA-2(1)	Independent Assessors
CA-5	Plan of Action and Milestones
CA-6	Authorization
CA-7	Continuous Monitoring

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

This report records what the assessors found when they carried out the Security and Privacy Assessment Plan. Its contents follow Appendix E, Assessment Reports, of NIST SP 800-53A Rev. 5 (January 2022, updated by release 5.2.0 in August 2025; current as of September 2026): a summary of every control assessed and its overall status, then the detail for each control. The report is one of the documents in the authorization package, with the security and privacy plans, the plan of action and milestones and an executive summary. Findings are facts: the assessor reports what was found and recommends, and the organization decides the risk response afterward. Information already in the security plan, risk assessment or plan of action and milestones need not be repeated here.

System name	System identifier	Security categorization	Assessment dates	Report version	Lead assessor
Fill in: system name, or the common controls assessed	Fill in: unique system identifier	Fill in: low, moderate or high	Fill in: first and last day	Fill in: draft or final, with version	Fill in: name and organization

1. Executive summary

• Assessment: Fill in: the reason for the assessment, for example initial authorization, and whether it was complete or partial
• Results: Fill in: the number of controls assessed, the number satisfied, and the number other than satisfied
• Most significant weaknesses: Fill in: the weaknesses that matter most to the authorizing official, one or two sentences each
• Assessor’s recommendations: Fill in: the priorities for correction, in order

2. Assessment information

Item	Description
Assessment plan	Fill in: plan version and the date the authorizing official or designated representative approved it
Sites assessed and dates	Fill in: sites, environments and dates
Assessors and independence	Fill in: names, organizations, and the independence the authorizing official required (CA-2(1))
Changes from the plan	Fill in: controls, methods or dates that changed, and why, or “none”
Previous results reused	Fill in: the controls, the earlier assessment and its date, or “none”
Inherited common controls	Fill in: the provider assessments relied on, with their dates
Limitations	Fill in: anything the assessors could not see or test, and its effect on the findings

3. Summary of results

Every control and control enhancement assessed, with its overall status (CA-2e):

Control or enhancement	Implementation (system-specific, hybrid or inherited)	Methods used	Overall result	Finding IDs
Fill in: for example AC-2	Fill in: implementation	Fill in: examine, interview, test	Fill in: satisfied or other than satisfied	Fill in: IDs from section 4, or “none”

4. Findings

Each determination statement in the assessment procedures produced a finding of “satisfied” or “other than satisfied”. A statement the assessors could not determine, for example because evidence was not provided or a parameter is not defined, is recorded as other than satisfied, with the reason.

Finding ID	Control and determination statement	Methods and objects	Depth and coverage	Result	Assessor comments	Potential impact	Recommendation	Severity
Fill in: ID	Fill in: for example AC-02d.01	Fill in: what was examined, who was interviewed, what was tested	Fill in: for example focused, focused	Fill in: satisfied or other than satisfied	Fill in: for other than satisfied: which part of the control is affected, and how the actual state differs from the expected state	Fill in: the potential for compromise of confidentiality, integrity or availability, or the privacy risk	Fill in: the recommended correction or improvement	Fill in: the organization’s severity scale, if it defines one

Guidance

SP 800-53A lets organizations define severity subcategories for “other than satisfied” findings, which helps the authorizing official and the risk assessment prioritize. Keep the evidence behind each determination: NIST expects organizations to retain enough of the assessment records to support an audit trail and reuse of evidence, even though the full set does not go in the report.

5. Privacy control results

Fill in: for a system that processes personally identifiable information, the privacy control results and the privacy risks they indicate, or a reference to a separate privacy assessment report; otherwise “the system does not process personally identifiable information”

6. Weaknesses corrected before the final report

The System owner reviewed the draft report and corrected the weaknesses below. The assessors reassessed each control before issuing this final report.

Finding ID	Correction made	Date reassessed	Result after reassessment
Fill in: ID	Fill in: correction	Fill in: date	Fill in: satisfied or other than satisfied

Guidance

SP 800-53A lets the system owner act on the assessor’s recommendations, or clarify misunderstandings, before the report is final, and requires the assessor to reassess any control changed in that time. This is a chance to fix quick items, not a replacement for the formal risk response that follows the final report.

7. From findings to action

• The System owner shall enter each weakness found in this assessment, and not corrected under section 6, in the system’s plan of action and milestones, unless the authorizing official accepts the risk (RA-7). (CA-5a)
• The System owner shall update the plan of action and milestones Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness, including the items this report adds. (CA-5b)
• The System owner shall include this report in the authorization package, with the security and privacy plans, the plan of action and milestones and an executive summary, for the authorizing official’s decision. (CA-6c.2)
• The System owner shall update the security and privacy plans where the assessment showed that the implementation differs from what they describe. (CA-2)

Finding ID	Plan of action and milestones item, or risk acceptance reference
Fill in: ID	Fill in: item ID or acceptance reference and date

8. Distribution

The results of this assessment are provided to Fill in: individuals or roles to whom control assessment results are to be provided Typical: the authorizing official, the system owner and the Chief Information Security Officer (CA-2f). For a system that processes personally identifiable information, the privacy control results are also provided to the Senior privacy official (CA-2f). This report describes the system’s weaknesses: it is marked Fill in: the organization’s handling marking and shared only with these recipients and the people they designate.

Recipient	Date provided
Fill in: name and title	Fill in: date

Federal systems

OMB Circular A-130, Appendix I, section 4.c(13), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls. Section 4.c(15) requires plans of action and milestones for weaknesses and deficiencies not associated with accepted risks, available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 5.f requires the agency to consider the Senior Agency Official for Privacy’s input in the authorization decision. As of September 2026.

• The System owner shall record in the plan of action and milestones each weakness in this report that is not associated with an accepted risk, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5a)
• For a system that processes personally identifiable information, the lead assessor shall provide the privacy control results to the Senior Agency Official for Privacy in time to inform the authorization decision, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-2f)

9. Assessor signature

The findings in this report are an impartial record of what the assessors found.

Name	Role	Signature	Date
Fill in: name	Lead assessor		Fill in: date

Appendix A. Evidence and sources

Fill in: the documents examined, the people interviewed by role, and the tests run with tool names and versions, or where the assessment records are kept

Appendix B. Scan and test results

Fill in: the vulnerability and configuration scan results and any penetration test report, or where they are kept