+CA [P] Assessment, Authorization, and Monitoring
---+CA-01 [P] Policy and Procedures
---+CA-02 [P] Control Assessments
---+CA-05 [P] Plan of Action and Milestones
---+CA-06 [P] Authorization
---+CA-07 [P] Continuous Monitoring
------+CA-07(04) [P] Risk Monitoring
|
CA [P] Assessment, Authorization, and Monitoring
Assessment, Authorization, and Monitoring
1. Przegląd
| Tytuł |
Norma |
|
CA-01 [P] Policy and Procedures
|
Control
- Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
- [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy that:
- Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
- Designate an [Assignement: official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
- Review and update the current assessment, authorization, and monitoring:
- Policy [Assignement: frequency] and following [Assignement: events] ; and
- Procedures [Assignement: frequency] and following [Assignement: events].
Discussion
Assessment, authorization, and monitoring policy and procedures address the controls in the CA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of assessment, authorization, and monitoring policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to assessment, authorization, and monitoring policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Assessment Objective
- an assessment, authorization, and monitoring policy is developed and documented;
- the assessment, authorization, and monitoring policy is disseminated to [Assignement: personnel or roles];
- assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;
- the assessment, authorization, and monitoring procedures are disseminated to [Assignement: personnel or roles];
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance;
- the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
- the [Assignement: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;
- the current assessment, authorization, and monitoring policy is reviewed and updated [Assignement: frequency];
- the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignement: events];
- the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignement: frequency];
- the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignement: events].
Assessment Method
Examine
Assessment, authorization, and monitoring policy and procedures
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with assessment, authorization, and monitoring policy responsibilities
organizational personnel with information security and privacy responsibilities
|
|
CA-02 [P] Control Assessments
|
Control
- Select the appropriate assessor or assessment team for the type of assessment to be conducted;
- Develop a control assessment plan that describes the scope of the assessment including:
- Controls and control enhancements under assessment;
- Assessment procedures to be used to determine control effectiveness; and
- Assessment environment, assessment team, and assessment roles and responsibilities;
- Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
- Assess the controls in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
- Produce a control assessment report that document the results of the assessment; and
- Provide the results of the control assessment to [Assignement: individuals or roles].
Discussion
Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented.
Organizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes.
Organizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs.
Organizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives.
To satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of [CA-2](#ca-2).
Assessment Objective
- an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
- a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
- a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
- a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
- a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
- a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
- the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
- controls are assessed in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
- controls are assessed in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
- a control assessment report is produced that documents the results of the assessment;
- the results of the control assessment are provided to [Assignement: individuals or roles].
Assessment Method
Examine
Assessment, authorization, and monitoring policy
procedures addressing assessment planning
procedures addressing control assessments
control assessment plan
control assessment report
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with control assessment responsibilities
organizational personnel with information security and privacy responsibilities
|
|
CA-05 [P] Plan of Action and Milestones
|
Control
- Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
- Update existing plan of action and milestones [Assignement: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
Discussion
Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB.
Assessment Objective
- a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
- existing plan of action and milestones are updated [Assignement: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
Assessment Method
Examine
Assessment, authorization, and monitoring policy
procedures addressing plan of action and milestones
control assessment plan
control assessment report
control assessment evidence
plan of action and milestones
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with plan of action and milestones development and implementation responsibilities
organizational personnel with information security and privacy responsibilities
|
|
CA-06 [P] Authorization
|
Control
- Assign a senior official as the authorizing official for the system;
- Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
- Ensure that the authorizing official for the system, before commencing operations:
- Accepts the use of common controls inherited by the system; and
- Authorizes the system to operate;
- Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
- Update the authorizations [Assignement: frequency].
Discussion
Authorizations are official management decisions by senior officials to authorize operation of systems, authorize the use of common controls for inheritance by organizational systems, and explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of agreed-upon controls. Authorizing officials provide budgetary oversight for organizational systems and common controls or assume responsibility for the mission and business functions supported by those systems or common controls. The authorization process is a federal responsibility, and therefore, authorizing officials must be federal employees. Authorizing officials are both responsible and accountable for security and privacy risks associated with the operation and use of organizational systems. Nonfederal organizations may have similar processes to authorize systems and senior officials that assume the authorization role and associated responsibilities.
Authorizing officials issue ongoing authorizations of systems based on evidence produced from implemented continuous monitoring programs. Robust continuous monitoring programs reduce the need for separate reauthorization processes. Through the employment of comprehensive continuous monitoring processes, the information contained in authorization packages (i.e., security and privacy plans, assessment reports, and plans of action and milestones) is updated on an ongoing basis. This provides authorizing officials, common control providers, and system owners with an up-to-date status of the security and privacy posture of their systems, controls, and operating environments. To reduce the cost of reauthorization, authorizing officials can leverage the results of continuous monitoring processes to the maximum extent possible as the basis for rendering reauthorization decisions.
Assessment Objective
- a senior official is assigned as the authorizing official for the system;
- a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
- before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
- before commencing operations, the authorizing official for the system authorizes the system to operate;
- the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
- the authorizations are updated [Assignement: frequency].
Assessment Method
Examine
Assessment, authorization, and monitoring policy
procedures addressing authorization
system security plan, privacy plan, assessment report, plan of action and milestones
authorization statement
other relevant documents or records
Interview
Organizational personnel with authorization responsibilities
organizational personnel with information security and privacy responsibilities
|
|
CA-07 [P] Continuous Monitoring
|
Control
Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:- Establishing the following system-level metrics to be monitored: [Assignement: system-level metrics];
- Establishing [Assignement: frequencies] for monitoring and [Assignement: frequencies] for assessment of control effectiveness;
- Ongoing control assessments in accordance with the continuous monitoring strategy;
- Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
- Correlation and analysis of information generated by control assessments and monitoring;
- Response actions to address results of the analysis of control assessment and monitoring information; and
- Reporting the security and privacy status of the system to [Assignement: organization-defined personnel or roles] [Assignement: organization-defined frequency].
Discussion
Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions.
Automation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PM-31](#pm-31), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SR-4](#sr-4), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) , and [SI-4](#si-4).
Assessment Objective
- a system-level continuous monitoring strategy is developed;
- system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;
- system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignement: system-level metrics];
- system-level continuous monitoring includes established [Assignement: frequencies] for monitoring;
- system-level continuous monitoring includes established [Assignement: frequencies] for assessment of control effectiveness;
- system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;
- system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
- system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;
- system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;
- system-level continuous monitoring includes reporting the security status of the system to [Assignement: personnel or roles] [Assignement: frequency];
- system-level continuous monitoring includes reporting the privacy status of the system to [Assignement: personnel or roles] [Assignement: frequency].
Assessment Method
Examine
Assessment, authorization, and monitoring policy
organizational continuous monitoring strategy
system-level continuous monitoring strategy
procedures addressing continuous monitoring of system controls
procedures addressing configuration management
control assessment report
plan of action and milestones
system monitoring records
configuration management records
impact analyses
status reports
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with continuous monitoring responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
|