Security Assessment and Authorization (CA)

Overview:The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:a. Establishment of [Assignment: organization-defined metrics] to be monitored;b. Establishment of [Assignment:... Read More

Overview:The organization accepts the results of an assessment of [Assignment: organization-defined information system] performed by [Assignment: organization-defined external organization] when the assessment meets [Assignment: organization-defined... Read More

Overview:The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to monitor the security controls in the information system on an ongoing basis. Supplemental Guidance:Organizations can... Read More

Overview:The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to conduct security control assessments. Supplemental Guidance:Independent assessors or assessment teams are individuals or... Read More

Overview:The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components. Supplemental Guidance:Independent penetration agents or teams are individuals or... Read More

Overview:The organization:a. Authorizes internal connections of [Assignment: organization-defined information system components or classes of components] to the information system; andb. Documents, for each internal connection, the interface... Read More

Overview:The organization conducts penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined information systems or system components]. Supplemental Guidance:Penetration testing is a specialized type of... Read More

Overview:The organization:a. Develops a plan of action and milestones for the information system to document the organization’s planned remedial actions to correct weaknesses or deficiencies noted duringthe assessment of the security controls... Read More

Overview:The organization employs [Selection: allow-all, deny-by-exception; deny-all, permit-by-exception] policy for allowing [Assignment: organization-defined information systems] to connect to external information systems. Supplemental Guidance... Read More

Overview:The organization:a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:1. A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management... Read More