Assessment, Authorization, and Monitoring Decision Worksheet

Assessment, Authorization, and Monitoring Decision Worksheet template: Every decision the Assessment, Authorization, and Monitoring family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Assessment, Authorization, and Monitoring family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every CA control in the baseline, with a typical value where the Assessment, Authorization, and Monitoring Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

30 decisions.

Decision	Control	Typical value	Who decides
Who assesses each system’s controls, and how is the assessor kept independent of the system?	CA-2, CA-2(1), CA-7(1)	An internal assessment team that sits outside the system’s development, operation and management chain, or a third-party assessor that the system owner does not contract or direct; the authorizing official confirms the level of independence is enough before the assessment plan is approved.	Authorizing official, with the Chief Information Security Officer
Who is the authorizing official for each system and for the common controls, and when does each authorization end?	CA-6	A senior executive with budget or mission responsibility for the system; the Chief Information Security Officer or Chief Information Officer for common controls. Each authorization has a termination date, usually three years, until the authorizing official moves the system to ongoing authorization.	Senior leader
Where are plans of action and milestones kept, and who reviews items that are past due?	CA-5	One plan of action and milestones per system, in the governance, risk and compliance tool or the POA&M template; the system owner updates it and the Chief Information Security Officer reviews past-due items each month.	Chief Information Security Officer
Which information exchanges need a written agreement, and which kind?	CA-3, CA-9	Every exchange with a system outside the authorization boundary has an interconnection security agreement or information exchange security agreement, or contract terms with the same content for an external service; internal connections are authorized by class of component and recorded in the system security plan.	Authorizing official, with the system owner
Which systems and components get penetration testing, and who does it?	CA-8, CA-8(1), CA-2(2)	Every High system and every internet-facing component, at least annually and after a significant change, by an independent team under rules of engagement the authorizing official approves.	Chief Information Security Officer
Personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated	CA-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated	CA-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	CA-1	Organization-level	Chief Information Security Officer
An official to manage the assessment, authorization, and monitoring policy and procedures	CA-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated	CA-1	Annually	Chief Information Security Officer
Events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated	CA-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated	CA-1	Annually	Chief Information Security Officer
Events that would require assessment, authorization, and monitoring procedures to be reviewed and updated	CA-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
The frequency at which to assess controls in the system and its environment of operation	CA-2	Annually for a subset of controls set by the system’s continuous monitoring strategy, so every control is assessed at least every three years and within the authorization period	Chief Information Security Officer
Individuals or roles to whom control assessment results are to be provided	CA-2	The authorizing official, the system owner and the Chief Information Security Officer	Chief Information Security Officer
Select one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; organization-defined type of agreement (see its row below)	CA-3	Interconnection security agreements or information exchange security agreements, and service level agreements or contract terms with the same content for external services	Chief Information Security Officer
The type of agreement used to approve and manage the exchange of information	CA-3	See the selection above	Chief Information Security Officer
The frequency at which to review and update agreements	CA-3	At least annually, and when either system makes a significant change that affects the exchange	Chief Information Security Officer
The frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities	CA-5	At least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness	Chief Information Security Officer
Frequency at which to update the authorizations	CA-6	At least every three years and after a significant change, or on the time- or event-driven basis the continuous monitoring strategy sets once the authorizing official moves the system to ongoing authorization	Chief Information Security Officer
System-level metrics to be monitored	CA-7	Open vulnerabilities by severity and age, configuration compliance rate, plan of action and milestones items past due, and unauthorized components found	Chief Information Security Officer
Frequencies at which to monitor control effectiveness	CA-7	Continuously for automated controls, and at least monthly for vulnerability, configuration and account data	Chief Information Security Officer
Frequencies at which to assess control effectiveness	CA-7	The schedule in the system’s continuous monitoring strategy, assessing a third of the controls each year so every control is assessed at least every three years	Chief Information Security Officer
Personnel or roles to whom the security status of the system is reported	CA-7	The authorizing official and the Chief Information Security Officer	Chief Information Security Officer
Frequency at which the security status of the system is reported	CA-7	At least quarterly	Chief Information Security Officer
Personnel or roles to whom the privacy status of the system is reported	CA-7	The authorizing official and the senior privacy official	Chief Information Security Officer
Frequency at which the privacy status of the system is reported	CA-7	At least quarterly	Chief Information Security Officer
System components or classes of components requiring internal connections to the system	CA-9	Classes of components that connect to the system from inside its boundary, such as printers, scanners, copiers, sensors, and mobile devices with the approved baseline configuration	Chief Information Security Officer
Conditions requiring termination of internal connections	CA-9	The component is retired or reassigned, fails a compliance check, is involved in an incident, or no longer needs the connection	Chief Information Security Officer
Frequency at which to review the continued need for each internal connection	CA-9	At least annually	Chief Information Security Officer