CA – Assessment, Authorization, and Monitoring

NIST SP 800-53B – CA – Assessment, Authorization, and Monitoring

1.Kravtext (engelskt original)#

CA-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] assessment, authorization, and monitoring policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
• c. Review and update the current assessment, authorization, and monitoring:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

CA-2 – Control Assessments#

• a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
• b. Develop a control assessment plan that describes the scope of the assessment including:
  • 1. Controls and control enhancements under assessment;
  • 2. Assessment procedures to be used to determine control effectiveness; and
  • 3. Assessment environment, assessment team, and assessment roles and responsibilities;
• c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• d. Assess the controls in the system and its environment of operation [organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
• e. Produce a control assessment report that document the results of the assessment; and
• f. Provide the results of the control assessment to [organization-defined individuals or roles].

CA-2(1) – Independent Assessors

Employ independent assessors or assessment teams to conduct control assessments.

CA-3 – Information Exchange#

• a. Approve and manage the exchange of information between the system and other systems using [interconnection security agreements or information exchange security agreements or memoranda of understanding or agreement or service level agreements or user agreements or non-disclosure agreements or [organization-defined type of agreement] ];
• b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
• c. Review and update the agreements [organization-defined frequency].

CA-5 – Plan of Action and Milestones#

• a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
• b. Update existing plan of action and milestones [organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

CA-6 – Authorization#

• a. Assign a senior official as the authorizing official for the system;
• b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
• c. Ensure that the authorizing official for the system, before commencing operations:
  • 1. Accepts the use of common controls inherited by the system; and
  • 2. Authorizes the system to operate;
• d. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
• e. Update the authorizations [organization-defined frequency].

CA-7 – Continuous Monitoring#

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

• a. Establishing the following system-level metrics to be monitored: [organization-defined system-level metrics];
• b. Establishing [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessment of control effectiveness;
• c. Ongoing control assessments in accordance with the continuous monitoring strategy;
• d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
• e. Correlation and analysis of information generated by control assessments and monitoring;
• f. Response actions to address results of the analysis of control assessment and monitoring information; and
• g. Reporting the security and privacy status of the system to [organization-defined personnel or roles][organization-defined frequency].

CA-7(1) – Independent Assessment

Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.

CA-7(4) – Risk Monitoring

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:

• (a) Effectiveness monitoring;
• (b) Compliance monitoring; and
• (c) Change monitoring.

CA-9 – Internal System Connections#

• a. Authorize internal connections of [organization-defined system components] to the system;
• b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
• c. Terminate internal system connections after [organization-defined conditions] ; and
• d. Review [organization-defined frequency] the continued need for each internal connection.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.