NIST SP 800-53 CA Assessment, Authorisation and Monitoring: Controls, Enhancements and Evidence

The CA family is where NIST SP 800-53 checks whether every other control actually works, and weak CA evidence undermines an entire authorisation package. CA (Assessment, Authorization, and Monitoring) covers control assessments, information exchanges, plans of action and milestones, the authorisation decision itself, continuous monitoring, penetration testing and internal connections. Because it governs the assurance process rather than a technology, teams often treat it as paperwork and then struggle to show assessors what was assessed, by whom, and what changed. This guide walks through each active CA control and its enhancements, shows which are in the SP 800-53B baselines, and lists the evidence that satisfies them. It is for system owners, ISSOs, GRC teams and assessors working with Rev. 5; it complements the NIST SP 800-53 Guide and does not repeat the RMF process itself.

Key takeaways

• Nine controls, seven active. CA-1 to CA-9 minus CA-4 (withdrawn); several enhancements, such as CA-3(1) to CA-3(5) and CA-7(2), are also withdrawn and should be removed from older control sets.
• Most of CA is in every baseline. CA-1, CA-2, CA-3, CA-5, CA-6, CA-7, CA-7(4) and CA-9 are in the low, moderate and high baselines; independence (CA-2(1), CA-7(1)) starts at moderate; penetration testing (CA-8, CA-8(1)) is high only.
• Parameters drive the work. CA controls are full of organisation-defined parameters: assessment frequency, monitoring metrics, POA&M update frequency, reauthorisation triggers. Set them explicitly in the SSP, or assessors have nothing to test against.
• CA-7 is the engine. Continuous monitoring with defined metrics, frequencies and risk monitoring (effectiveness, compliance and change) is what makes ongoing authorisation possible.
• Connections are identities. CA-3 information exchanges and CA-9 internal connections are usually implemented by service accounts, API keys and workload identities; documenting the connection without the credential behind it misses the risk.

The CA family at a glance

Baseline allocations above are from the NIST OSCAL SP 800-53B baseline profiles (Rev. 5). Overlays and programmes such as FedRAMP add their own selections and parameter values; see the NIST SP 800-53B Control Baselines and Tailoring Guide.

CA-2 Control Assessments

CA-2 requires you to select an appropriate assessor or team, write an assessment plan covering the controls in scope, the procedures and the environment, roles and responsibilities, have the plan approved by the authorising official or a designated representative before the assessment, assess at a defined frequency, produce an assessment report and give the results to defined individuals or roles.

• Assessment plan: list every control and enhancement in scope, the SP 800-53A procedures (examine, interview, test) per control, sample sizes, and test environment. See the NIST SP 800-53A Guide.
• Independence (CA-2(1)): record why the assessor is independent: reporting line, no role in building or operating the system, no conflicting incentive.
• Specialised assessments (CA-2(2)): define the frequency, the types (the control offers options such as security instrumentation, automated security test cases and data leakage or data loss assessment) and whether they are announced or unannounced, as the parameters ask.
• Reuse (CA-2(3)): state the conditions under which external results are accepted, such as scope, date and assessor qualification, and record which controls rely on them.

CA-3 and CA-9: exchanges and connections

CA-3 covers information exchange between the system and other systems. It requires you to approve and manage each exchange using a defined agreement type (the control lists interconnection security agreements, information exchange security agreements, memoranda of understanding or agreement, service level agreements, user agreements and non-disclosure agreements), document interface characteristics, security and privacy requirements, controls, responsibilities and the impact level of the information, and review the agreements at a defined frequency. CA-9 applies a similar discipline to internal connections of defined system components: authorise them, document them, terminate them after defined conditions and review whether each is still needed. CA-9(1) adds compliance checks on components before connection.

CA-3(6) Transfer Authorizations, in the high baseline, requires you to verify that the individuals or systems sending data have the required write authorisation before you accept it. CA-3(7) asks you to identify transitive (downstream) exchanges and make sure they stop when the downstream controls cannot be verified, which matters for data shared onward through SaaS integrations. The SaaS Integration Security Questionnaire Template is a practical starting point.

CA-5 and CA-6: POA&M and the authorisation decision

CA-5 requires a plan of action and milestones documenting planned remediation of weaknesses from assessments and known vulnerabilities, updated at a defined frequency from assessments, audits and continuous monitoring. CA-5(1) adds automation for accuracy and currency. The Plan of Action and Milestones (POA&M) Guide covers structure and fields.

CA-6 requires a senior official as authorising official for the system and another (which can be the same person) for common controls offered for inheritance. Before operation, the system's authorising official must accept the inherited common controls and authorise the system; the common control authorising official must authorise those controls for inheritance; and authorisations are updated at a defined frequency. CA-6(1) and CA-6(2) describe joint authorisation by several officials within or across organisations, useful for shared platforms.

• Evidence for CA-6: appointment letters for authorising officials, the signed authorisation decision with its terms and conditions and termination date (or ongoing authorisation basis), the record of common controls accepted, and the reauthorisation triggers.
• Ongoing authorisation: SP 800-37 Rev. 2 supports ongoing system and common control authorisation, fed by CA-7. See the Continuous Authorisation and Ongoing Authorisation Guide.

CA-7 Continuous Monitoring

CA-7 requires a system-level continuous monitoring strategy, consistent with the organisation-level strategy, that sets system-level metrics, monitoring frequencies and assessment frequencies, runs ongoing control assessments and metric monitoring, correlates and analyses the results, responds to findings and reports security and privacy status at a defined frequency. NIST SP 800-137 is the main guideline for building the programme.

Among the enhancements outside the baselines, CA-7(3) trend analyses use empirical data to adjust what and how often you monitor, CA-7(5) consistency analysis checks that policies and controls operate consistently, and CA-7(6) adds automation for accurate, current and available results. CA-7(2) Types of Assessments is withdrawn.

CA-8 Penetration Testing

CA-8 requires penetration testing at a defined frequency on defined systems or components; CA-8(1) requires an independent tester or team; both are in the high baseline. CA-8(2) adds red team exercises under rules of engagement and CA-8(3) facility penetration testing of physical access points. For moderate systems the controls are optional, but many organisations add CA-8 through tailoring because it gives the strongest evidence that controls resist attack. Evidence: rules of engagement, scope and authorisation letters, tester independence, reports, and the POA&M items raised from findings. See the Penetration Testing Guide and the Red Team Rules of Engagement Template.

How to evidence CA controls

Implementing the CA family: a phased approach

1. Clean up the control set: remove CA-4, CA-3(1) to CA-3(5) and CA-7(2), which are withdrawn in Rev. 5, and confirm your baseline plus overlay selections.
2. Set the parameters: write every CA organisation-defined parameter (frequencies, roles, metrics, conditions) into the system security plan; the System Security Plan Template has the structure.
3. Build the registers: an exchange register for CA-3 and an internal connection register for CA-9, each with the credential behind the connection.
4. Stand up the POA&M pipeline: make assessment, audit, scan and monitoring findings flow into one POA&M with owners.
5. Run the first assessment: approved plan, independent assessor where required, report, POA&M entries, then the authorisation decision.
6. Move to continuous monitoring: automate the metrics that can be automated, put manual controls on a rotating schedule, and report monthly. Pilot with one system before rolling out the template to others.

Decision guidance

• Periodic versus ongoing authorisation: stay with periodic reauthorisation if monitoring is mostly manual; move to ongoing authorisation only when CA-7 metrics are automated, trusted and reviewed by the authorising official.
• Internal versus third-party assessors: an internal team in a separate reporting line can meet CA-2(1) for many organisations; programmes such as FedRAMP define their own assessor requirements, so check the programme rules. See the FedRAMP Guide.
• Small organisations: combine CA-3 and CA-9 registers, reuse external assessments under CA-2(3) where conditions are met, and keep the POA&M in one tool.
• Large estates: use common control providers with their own authorisations under CA-6 so systems inherit assessed controls instead of reassessing them.

Where identity fits

Many CA artefacts describe connections and monitoring without naming the identities that make them work. Add the credential to every CA-3 and CA-9 record, include non-human account metrics (unowned, unrotated or over-privileged service accounts and keys) in the CA-7 metric catalogue, and scope CA-8 tests to include credential theft and abuse of integrations. The NIST SP 800-53 IA Identification and Authentication and NIST SP 800-53 AC Access Control family guides cover the controls those metrics test.

Detection and measurement

• Authorisation currency: share of systems with a current authorisation (target: all).
• Assessment coverage: share of controls assessed within their defined frequency.
• POA&M health: overdue POA&M items as a share of open items, and median age of high-risk items.
• Connection coverage: share of external and internal connections with a current agreement or approval and a named credential owner.
• Monitoring automation: share of CA-7 metrics collected automatically.

Framework mapping

Mappings are our interpretation; for the official crosswalk use the NIST mapping resources.

Common failure patterns

• Undefined parameters: "assess periodically" or "monitor regularly" gives assessors nothing to test and usually results in a finding.
• Assessment plan approved after the fact: CA-2 requires approval before the assessment.
• Expired authorisations: systems keep running past their authorisation termination date with no decision recorded.
• POA&M as a graveyard: items with no owner or milestone, and monitoring findings never added.
• Connections without credentials: interconnection agreements that never name the service account or key, so nobody revokes it when the agreement ends.
• Withdrawn controls in the SSP: legacy Rev. 4 IDs that no longer exist confuse assessors and inflate effort.

Practitioner checklist

• Remove withdrawn CA controls and enhancements from your control set.
• Define every CA parameter in the system security plan.
• Get the assessment plan approved before each assessment.
• Document assessor independence for CA-2(1) and CA-7(1).
• Keep CA-3 and CA-9 registers that name the credential and owner for each connection.
• Feed all findings into one POA&M and update it on schedule.
• Track authorisation termination dates and reauthorisation triggers.
• Publish a CA-7 metric catalogue, including non-human identity metrics.

Standards and references

• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• NIST: OSCAL content, SP 800-53 Rev. 5 catalogue and SP 800-53B baseline profiles
• NIST: SP 800-53B, Control Baselines for Information Systems and Organizations
• NIST: SP 800-53A Rev. 5, Assessing Security and Privacy Controls
• NIST: SP 800-37 Rev. 2, Risk Management Framework
• NIST: SP 800-137, Information Security Continuous Monitoring
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: NIST SP 800-53 Guide · Continuous Authorisation and Ongoing Authorisation Guide · Plan of Action and Milestones (POA&M) Guide · NIST SP 800-53A Guide