CA – Assessment, Authorization, and Monitoring

NIST SP 800-53 Rev. 5 – CA – Assessment, Authorization, and Monitoring

1.Kravtext (engelskt original)#

CA-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] assessment, authorization, and monitoring policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
• c. Review and update the current assessment, authorization, and monitoring:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

CA-2 – Control Assessments#

• a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
• b. Develop a control assessment plan that describes the scope of the assessment including:
  • 1. Controls and control enhancements under assessment;
  • 2. Assessment procedures to be used to determine control effectiveness; and
  • 3. Assessment environment, assessment team, and assessment roles and responsibilities;
• c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• d. Assess the controls in the system and its environment of operation [organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
• e. Produce a control assessment report that document the results of the assessment; and
• f. Provide the results of the control assessment to [organization-defined individuals or roles].

CA-2(1) – Independent Assessors

Employ independent assessors or assessment teams to conduct control assessments.

CA-2(2) – Specialized Assessments

Include as part of control assessments, [organization-defined specialized assessment frequency], [announced or unannounced], [in-depth monitoring or security instrumentation or automated security test cases or vulnerability scanning or malicious user testing or insider threat assessment or performance and load testing or data leakage or data loss assessment or [organization-defined other forms of assessment] ].

CA-2(3) – Leveraging Results from External Organizations

Leverage the results of control assessments performed by [organization-defined external organization(s)] on [organization-defined system] when the assessment meets [organization-defined requirements].

CA-3 – Information Exchange#

• a. Approve and manage the exchange of information between the system and other systems using [interconnection security agreements or information exchange security agreements or memoranda of understanding or agreement or service level agreements or user agreements or non-disclosure agreements or [organization-defined type of agreement] ];
• b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
• c. Review and update the agreements [organization-defined frequency].

CA-3(1) – Unclassified National Security System Connections

CA-3(2) – Classified National Security System Connections

CA-3(3) – Unclassified Non-national Security System Connections

CA-3(4) – Connections to Public Networks

CA-3(5) – Restrictions on External System Connections

CA-3(6) – Transfer Authorizations

Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.

CA-3(7) – Transitive Information Exchanges

• (a) Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a ; and
• (b) Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.

CA-4 – Security Certification#

CA-5 – Plan of Action and Milestones#

• a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
• b. Update existing plan of action and milestones [organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

CA-5(1) – Automation Support for Accuracy and Currency

Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [organization-defined automated mechanisms].

CA-6 – Authorization#

• a. Assign a senior official as the authorizing official for the system;
• b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
• c. Ensure that the authorizing official for the system, before commencing operations:
  • 1. Accepts the use of common controls inherited by the system; and
  • 2. Authorizes the system to operate;
• d. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
• e. Update the authorizations [organization-defined frequency].

CA-6(1) – Joint Authorization — Intra-organization

Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.

CA-6(2) – Joint Authorization — Inter-organization

Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.

CA-7 – Continuous Monitoring#

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

• a. Establishing the following system-level metrics to be monitored: [organization-defined system-level metrics];
• b. Establishing [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessment of control effectiveness;
• c. Ongoing control assessments in accordance with the continuous monitoring strategy;
• d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
• e. Correlation and analysis of information generated by control assessments and monitoring;
• f. Response actions to address results of the analysis of control assessment and monitoring information; and
• g. Reporting the security and privacy status of the system to [organization-defined personnel or roles][organization-defined frequency].

CA-7(1) – Independent Assessment

Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.

CA-7(2) – Types of Assessments

CA-7(3) – Trend Analyses

Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.

CA-7(4) – Risk Monitoring

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:

• (a) Effectiveness monitoring;
• (b) Compliance monitoring; and
• (c) Change monitoring.

CA-7(5) – Consistency Analysis

Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [organization-defined actions].

CA-7(6) – Automation Support for Monitoring

Ensure the accuracy, currency, and availability of monitoring results for the system using [organization-defined automated mechanisms].

CA-8 – Penetration Testing#

Conduct penetration testing [organization-defined frequency] on [organization-defined system(s) or system components].

CA-8(1) – Independent Penetration Testing Agent or Team

Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.

CA-8(2) – Red Team Exercises

Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [organization-defined red team exercises].

CA-8(3) – Facility Penetration Testing

Employ a penetration testing process that includes [organization-defined frequency][announced or unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.

CA-9 – Internal System Connections#

• a. Authorize internal connections of [organization-defined system components] to the system;
• b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
• c. Terminate internal system connections after [organization-defined conditions] ; and
• d. Review [organization-defined frequency] the continued need for each internal connection.

CA-9(1) – Compliance Checks

Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.