800-53 · CA Assessment, Authorization and Monitoring
CA-2
Control Assessments
frameworkNIST SP 800-53 Rev 5.2
sectionCA Assessment, Authorization and Monitoring
csf 2.0GV.OC-03 GV.OV-03 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01
topicsCompliance
frameworks3 7 0
Official texta. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
b. Develop a control assessment plan that describes the scope of the assessment including:
1. Controls and control enhancements under assessment;
2. Assessment procedures to be used to determine control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;
c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
d. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
e. Produce a control assessment report that document the results of the assessment; and
f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Develop a control assessment plan that describes the scope of the assessment including:
1. Controls and control enhancements under assessment;
2. Assessment procedures to be used to determine control effectiveness; and
3. Assessment environment, assessment team, and assessment roles and responsibilities;
c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
d. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
e. Produce a control assessment report that document the results of the assessment; and
f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-03GV.OV-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | Same topic: Compliance (editorial pick)1 loosely related (not mappings)ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping |
| ISO 27001 | A.5.31A.5.36Clause 9.1A.5.30A.5.35A.8.29Clause 9.2Clause 9.2.1Clause 9.2.2 | Legal, statutory, regulatory and contractual requirements; Compliance with policies, rules and standards for information security… | Crosswalk | Same topic: Compliance (editorial pick) NIST SP 800-53 → ISO 27001 mapping 8 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.OV-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping A.8.34 Protection of information systems during audit testing Only shares CSF GV.OV-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-03: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.5CIS 7.6CIS 7.7 | Establish and Maintain a Vulnerability Management Process; Perform Automated Vulnerability Scans of Internal Enterprise Assets… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+6 more loosely related (not mappings)CIS 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities Only shares CSF ID.RA-01: related, not a mapping CIS 18.1 Establish and Maintain a Penetration Testing Program Only shares CSF ID.RA-01: related, not a mapping CIS 18.2 Perform Periodic External Penetration Tests Only shares CSF ID.RA-01: related, not a mapping …and 2 more in the downloads | |
| SOC 2 | CC4.1CC4.2 | Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies | Editorial | Same topic: Compliance (editorial pick)1 loosely related (not mappings)CC7.1 Detecting configuration changes and new vulnerabilities Only shares CSF ID.RA-01: related, not a mapping |
| PCI DSS | 12.4.2 | Service providers: quarterly reviews of operational tasks | Editorial | Same topic: Compliance (editorial pick)18 loosely related (not mappings)11.3.1 Internal vulnerability scans every three months Only shares CSF GV.OV-03, ID.IM-03, ID.RA-01: related, not a mapping 11.3.2 External ASV scans every three months Only shares CSF GV.OV-03, ID.IM-03, ID.RA-01: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF GV.OV-03, ID.IM-02, ID.RA-01: related, not a mapping 10.7.2 Critical security control failures detected and reported Only shares CSF GV.OV-03, ID.IM-03: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Only shares CSF GV.OV-03, ID.IM-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.OV-03, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF GV.OC-03, ID.IM-02: related, not a mapping …and 10 more in the downloads |
| CMMC | CA.L2-3.12.1CA.L2-3.12.2CA.L2-3.12.3CA.L2-3.12.4 | Security Control Assessment; Plan of Action… | Crosswalk | Same topic: Compliance (editorial pick) NIST SP 800-171r2 Appendix D 7 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.OV-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping |
| HIPAA | §164.308(a)(8)§164.316(b) | Evaluation; Documentation | Crosswalk | Same topic: Compliance (editorial pick) NIST HIPAA → SP 800-53 crosswalk 25 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(1) Security Management Process Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(a)(3) Workforce Security Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 17 more in the downloads |
| GDPR | Art.5(2) | Principles relating to processing of personal data | Editorial | Same topic: Compliance (editorial pick)1 loosely related (not mappings) |
| NIS2 | 2.22.3 | Compliance monitoring; Independent review of information and network security | Editorial | Same topic: Compliance (editorial pick)6 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.OC-03: related, not a mapping |
| Essential Eight | ISM-0304ISM-1407ISM-1501ISM-1690 | Applications other than office productivity suites, web browsers and their extensions…; The latest release, or the previous release, of operating systems are used… | No mapping. Only shares CSF ID.RA-01: related, not a mapping+25 more loosely related (not mappings)ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads | |
| DORA | Art.5(2)(f)Art.6(6)Art.6(7) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Compliance (editorial pick) |
| CPS 234 | Para 32Para 33Para 34 | Internal audit reviews control design and effectiveness; Assurance provided by appropriately skilled personnel… | Editorial | Same topic: Compliance (editorial pick)3 loosely related (not mappings)Para 17 Keep capability current as threats and vulnerabilities change Only shares CSF ID.RA-01: related, not a mapping Para 27 Systematic testing programme for control effectiveness Only shares CSF ID.RA-01: related, not a mapping Para 30 Testing by skilled, functionally independent specialists Only shares CSF ID.RA-01: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.RA-01: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.