Guide for Assessing the Security 

Controls in Federal Information 

Systems

Building Effective Security Assessment Plans 

Ron Ross 

Arnold Johnson 

Stu Katzke 

Patricia Toth 

Gary Stoneburner 

George Rogers 

 NIST Special Publication 800-53A 

I N F O R M A T I O N S E C U R I T Y

FINAL PUBLIC DRAFT

Computer Security Division 

Information Technology Laboratory 

National Institute of Standards and Technology 

Gaithersburg, MD 20899-8930 

December 2007 

U.S. Department of Commerce 

Carlos M. Gutierrez, Secretary 

National Institute of Standards and Technology 

James M. Turner, Acting Director 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Notes to Reviewers

The final public draft of NIST Special Publication 800-53A contains some important changes to 

improve the efficiency and effectiveness of the document in supporting individuals and 

organizations conducting assessments of security controls in federal information systems. These 

changes have been driven by the extensive comments from the public and private sectors during 

the last public comment period. There were significant differences of opinion from the public 

respondents regarding preferences for the greater specificity in assessment procedures offered in 

the second public draft or the greater flexibility in assessment procedures offered in the third 

public draft. There were compelling arguments made for both approaches. 

To address the needs of all of our customers, NIST chose to use a modified third public draft 

format to define the general assessment procedures for the security controls in NIST Special 

Publication 800-53, thus preserving the flexibility desired by organizations in creating their 

individualized security assessment plans. To address the concerns of those organizations that 

desired a greater level of specificity and a checklist approach in the assessment procedures, NIST 

initiated the Assessment Case Development Project, an inter-agency task force of experienced 

assessors, who are developing specific exemplary assessment cases for the assessment procedures 

in NIST Special Publication 800-53A. The assessment cases, described in Appendix J of this 

publication, provide an assessor’s view of cost-effective and efficient techniques and methods for 

carrying out the more generic assessment procedures in Special Publication 800-53A to satisfy 

the stated assessment objectives. The assessment cases also address the level of effort expended 

in an assessment through the use of specific depth and coverage values incorporated into the 

assessment cases for security controls in low-, moderate-, and high-impact information systems. 

The Assessment Case Development Project deliverables (i.e., the completed assessment cases) 

will be posted on the NIST web site as they are completed beginning in January 2008 and 

culminating in March 2008 with the final publication of Special Publication 800-53A. The 

assessment cases will not be part of this publication and will not be mandatory for use by federal 

agencies. Rather, assessment cases offer the opportunity for a community-wide effort to provide 

worked examples of assessor actions and activities that more cost-effectively address the 

assessment of security controls and provide a web-based delivery mechanism to get state-of-the 

practice assessment information to assessors. 

In addition to the assessment case initiative described above, the final public draft includes: 

• Updated assessment procedures based on NIST Special Publication 800-53, Revision 2, 

(including industrial control system information); 

• A reorganization and streamlining of the material in the Chapters One, Two, and Three to 

provide greater clarity in describing the components of an assessment procedure and how the 

components are used within the context of a security assessment plan; 

• Minor modifications to the assessment method definitions in Appendix D; 

• A streamlined assessment procedure format in Appendix F for expressing assessment 

objectives, assessment methods, and assessment objects; 

• A specific assignment of (L) (M) (H) designators to assessment methods to indicate applicability 

to low-impact, moderate-impact, and high-impact information systems, respectively; and 

• Relocating the Risk Management Framework to NIST Special Publication 800-39 (Initial 

Public Draft), Managing Risk from Information Systems: An Organizational Perspective. 

PAGE ii 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Comments on this public draft will be accepted through January 31, 2008. Comments should be 

forwarded to the Computer Security Division, Information Technology Laboratory at NIST or 

submitted via email to sec-cert@nist.gov. The FISMA Implementation Project main website at 

http://csrc.nist.gov/sec-cert contains information on all of the FISMA-related security standards 

and guidelines and how the publications can be used to manage risk from information systems 

and build comprehensive information security programs. 

-- RON ROSS

 PROJECT LEADER, FISMA IMPLEMENTATION PROJECT 

PAGE iii 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Reports on Computer Systems Technology 

The Information Technology Laboratory (ITL) at the National Institute of Standards and 

Technology (NIST) promotes the U.S. economy and public welfare by providing technical 

leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 

methods, reference data, proof of concept implementations, and technical analyses to advance the 

development and productive use of information technology. ITL’s responsibilities include the 

development of management, administrative, technical, and physical standards and guidelines for 

the cost-effective security and privacy of other than national security-related information in 

federal information systems. The Special Publication 800-series reports on ITL’s research, 

guidelines, and outreach efforts in information system security, and its collaborative activities 

with industry, government, and academic organizations. 

PAGE iv 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Authority 

This document has been developed by the National Institute of Standards and Technology (NIST) 

to further its statutory responsibilities under the Federal Information Security Management Act 

(FISMA) of 2002, P.L. 107-347. NIST is responsible for developing standards and guidelines, 

including minimum requirements, for providing adequate information security for all agency 

operations and assets, but such standards and guidelines shall not apply to national security 

systems. This guideline is consistent with the requirements of the Office of Management and 

Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as 

analyzed in Circular A-130, Appendix IV: Analysis of Key Sections. Supplemental information 

is provided in A-130, Appendix III. 

This guideline has been prepared for use by federal agencies. However, it may also be used by 

nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution 

would be appreciated by NIST.) 

Nothing in this document should be taken to contradict standards and guidelines made mandatory 

and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor 

should these guidelines be interpreted as altering or superseding the existing authorities of the 

Secretary of Commerce, Director of the OMB, or any other federal official.

NIST Special Publication 800-53A, 396 pages 

(December 2007) CODEN: NSPUE2

 

 

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply 

recommendation or endorsement by the National Institute of Standards and Technology, nor is it 

intended to imply that the entities, materials, or equipment are necessarily the best available for the 

purpose. 

THE PUBLIC COMMENT PERIOD FOR THIS DOCUMENT IS DECEMBER 20, 2007 TO JANUARY 31, 2008. 

COMMENTS MAY BE SUBMITTED TO THE COMPUTER SECURITY DIVISION, INFORMATION TECHNOLOGY 

LABORATORY, NIST VIA ELECTRONIC MAIL AT SEC-CERT@NIST.GOV OR VIA REGULAR MAIL AT

100 BUREAU DRIVE (MAIL STOP 8930) GAITHERSBURG, MD 20899-8930 

PAGE v 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Compliance with NIST Standards and Guidelines 

NIST develops and issues standards, guidelines, and other publications to assist federal agencies 

in implementing the Federal Information Security Management Act (FISMA) of 2002 and in 

managing cost-effective programs to protect their information and information systems. 

• Federal Information Processing Standards (FIPS) are developed by NIST in accordance 

with FISMA. FIPS are approved by the Secretary of Commerce and are compulsory and 

binding for federal agencies. Since FISMA requires that federal agencies comply with 

these standards, agencies may not waive their use. 

• Guidance documents and recommendations are issued in the NIST Special Publication 

(SP) 800-series. Office of Management and Budget (OMB) policies (including OMB 

FISMA Reporting Instructions for the Federal Information Security Management Act and 

Agency Privacy Management) state that for other than national security programs and 

systems, agencies must follow NIST guidance.1

• Other security-related publications, including interagency and internal reports (NISTIRs) 

and ITL Bulletins, provide technical and other information about NIST's activities. 

These publications are mandatory only when so specified by OMB. 

Schedule for Compliance with NIST Standards and Guidelines 

• For legacy information systems, agencies are expected to be in compliance with NIST 

security standards and guidelines within one year of the publication date unless otherwise 

directed by OMB or NIST.2

• For information systems under development, agencies are expected to be in compliance 

with NIST security standards and guidelines immediately upon deployment of the 

system. 

 

1

 While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within 

NIST’s guidance in how agencies apply the guidance. Unless otherwise specified by OMB, the 800-series guidance 

documents published by NIST generally allow agencies some latitude in their application. Consequently, the 

application of NIST guidance by agencies can result in different security solutions that are equally acceptable, 

compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. 

When assessing agency compliance with NIST guidance, auditors, evaluators, and/or assessors should consider the 

intent of the security concepts and principles articulated within the particular guidance document and how the agency 

applied the guidance in the context of its specific mission responsibilities, operational environments, and unique 

organizational conditions. 

2

 The one-year compliance date for revisions to NIST Special Publications applies only to the new and/or updated 

material in the publications resulting from the periodic revision process. Agencies are expected to be in compliance 

with previous versions of NIST Special Publications within one year of the publication date of the previous versions. 

PAGE vi 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Acknowledgements 

The authors, Ron Ross, Arnold Johnson, Stu Katzke, Patricia Toth, Gary Stoneburner, and 

George Rogers, wish to thank their colleagues who reviewed drafts of this document and 

contributed to its development. A special note of thanks is also extended to Peggy Himes and 

Elizabeth Lennon for their superb technical editing and administrative support. The authors also 

gratefully acknowledge and appreciate the many contributions from individuals in the public and 

private sectors whose thoughtful and constructive comments improved the quality and usefulness 

of this publication. 

A special acknowledgement is also given to the participants in the Assessment Case Development 

Project (described in Appendix J of this publication) who have put forth significant effort in 

helping to develop exemplary assessment cases for the assessment procedures in NIST Special 

Publication 800-53A. These individuals include: Lynn Henderson, Sue Acosta, Peter Crichlow, 

Ryan Higgins, Ed Siewick, and John Wyatt from the Department of Justice; Tony Bailey, 

Ja’Nelle Devore, Ed Lewis, and Lucas Samaras from the Department of Energy; Arvid Knutsen, 

Jim Harrell, Gerald Butler, and Waylon Krush from the Department of Transportation; Sharon 

Ehlers, Mike Grandy, Steven Rodrigo, Dave Williams, and Troy McCoy from the Office of the 

Director of National Intelligence; Bennett Hodge (Booz Allen Hamilton); and Gary Stoneburner 

(Johns Hopkins Applied Physics Laboratory).

PAGE vii 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

In addition to the security requirements established by FISMA, there may also be specific security 

requirements in different business areas within agencies that are governed by other laws, Executive 

Orders, directives, policies, regulations, or associated governing documents, (e.g., the Health 

Insurance Portability and Accountability Act of 1996, the Federal Financial Management 

Improvement Act of 1996, or OMB Circular A-127 on Financial Management Systems). These 

requirements may not be equivalent to the security requirements and implementing security 

controls required by FISMA or may enhance or further refine the security requirements and security 

controls. It is important that agency officials (including authorizing officials, chief information 

officers, senior agency information security officers, information system owners, information 

system security officers, and acquisition authorities) take steps to ensure that: (i) all appropriate 

security requirements are addressed in agency acquisitions of information systems and information 

system services; and (ii) all required security controls are implemented in agency information 

systems. See http://csrc.nist.gov/sec-cert/ca-compliance.html for additional information on FISMA 

compliance. 

FEDERAL INFORMATION SECURITY MANAGEMENT ACT

IMPLEMENTING SECURITY STANDARDS AND GUIDELINES

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, is a 

mandatory, non-waiverable standard developed in response to the Federal Information Security 

Management Act of 2002. To comply with the federal standard, agencies must first determine the 

security category of their information system in accordance with the provisions of FIPS 199, 

Standards for Security Categorization of Federal Information and Information Systems, and then 

apply the appropriate set of baseline security controls in NIST Special Publication 800-53,

Recommended Security Controls for Federal Information Systems. Agencies have flexibility in 

applying the baseline security controls in accordance with the tailoring guidance provided in 

Special Publication 800-53. This allows agencies to adjust the security controls to more closely fit 

their mission requirements and operational environments. 

The combination of FIPS 200 and NIST Special Publication 800-53 requires a foundational level of 

security for all federal information and information systems (other than national security 

information and information systems). The agency's risk assessment validates the security control 

set and determines if any additional controls are needed to protect agency operations (including 

mission, functions, image, or reputation), agency assets, individuals, other organizations, or the 

Nation. The resulting set of security controls establishes a level of “security due diligence” for the 

federal agency and its contractors. 

PAGE viii 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

DEVELOPING COMMON INFORMATION SECURITY FOUNDATIONS

COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES

In developing standards and guidelines required by the Federal Information Security Management Act 

(FISMA), NIST consults with other federal agencies and offices as well as the private sector to improve 

information security, avoid unnecessary and costly duplication of effort, and ensure that NIST standards 

and guidelines are complementary with standards and guidelines employed for the protection of 

national security systems. In addition to its comprehensive public review and vetting process, NIST is 

working with the Office of the Director of National Intelligence (ODNI), the Department of Defense 

(DOD), and the Committee on National Security Systems (CNSS) to establish a common foundation for 

information security across the federal government. The common foundation for information security 

will provide the Intelligence, Defense, and Civil sectors of the federal government and their support 

contractors, more uniform and consistent ways to manage the risk to organizational operations, 

organizational assets, individuals, other organizations, and the Nation that results from the operation 

and use of information systems. In another collaboration initiative, NIST is working with public and 

private sector entities to establish specific mappings and relationships between the security standards 

and guidelines developed by NIST and the International Organization for Standardization and 

International Electrotechnical Commission (ISO/IEC) 27001, Information Security Management 

System (ISMS). 

PAGE ix 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Preface

Security control assessments are not about checklists, simple pass-fail results, or generating 

paperwork to pass inspections or audits—rather, security controls assessments are the principal 

vehicle used to verify that the implementers and operators of information systems are meeting 

their stated security goals and objectives. NIST Special Publication 800-53A, Guide for 

Assessing the Security Controls in Federal Information Systems, is written to facilitate security 

control assessments conducted within an effective risk management framework. The assessment 

results provide key organizational officials: 

• Evidence about the effectiveness of the security controls in the organizational information 

system; 

• An indication of the quality of the risk management processes employed within the 

organization; and 

• Information about the strengths and weaknesses of an organization’s information system 

which is supporting critical federal applications and missions in a global environment of 

sophisticated threats. 

The findings produced by assessors are used primarily in determining the overall effectiveness of 

the security controls in an information system and in providing credible and meaningful inputs to 

the organization’s security accreditation (information system authorization) process. A wellexecuted assessment helps to determine the validity of the security controls contained in the 

information system security plan (and subsequently employed in the information system) and to 

facilitate a cost-effective approach to correcting any deficiencies in the system in an orderly and 

disciplined manner consistent with the organization’s mission requirements. 

NIST Special Publication 800-53A is a companion guideline to NIST Special Publication 800-53, 

Recommended Security Controls for Federal Information Systems. Each publication provides 

guidance for implementing the steps in the NIST Risk Management Framework. Special 

Publication 800-53 covers the steps in the Risk Management Framework that address security 

control selection and supplementation (i.e., determining what security controls are needed to 

protect organizational operations and assets, individuals, other organizations, and the Nation) in 

accordance with the security requirements stated in FIPS 200.3

 This includes: (i) selecting an 

initial set of baseline security controls based on a FIPS 199 impact analysis;4

 (ii) tailoring the 

baseline controls; and (iii) supplementing the controls, as necessary, based on an organizational 

assessment of risk. Special Publication 800-53A covers both the security control assessment and 

continuous monitoring steps in the Risk Management Framework and provides guidance on the 

security assessment process. This guidance includes how to build effective security assessment 

plans and how to manage assessment results. 

NIST Special Publication 800-53A has been developed with the intention of enabling 

organizations to tailor and supplement the basic assessment procedures provided. The concepts 

of tailoring and supplementation used in this document are similar to the concepts described in 

NIST Special Publication 800-53. Tailoring involves scoping the assessment procedures to 

match the characteristics of the information system under assessment. The tailoring process 

provides organizations with the flexibility needed to avoid overly constrained assessment 

approaches. Supplementation involves adding assessment procedures or assessment details to 

 

3

 FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. 

4

 FIPS 199, Standards for Security Categorization of Federal Information and Information Systems. 

PAGE x 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

adequately meet the organization’s risk management needs (e.g., adding assessment objectives or 

adding organization-specific details such as system and platform-specific information for selected 

security controls employed in the hardware, software, and firmware). Supplementation decisions 

are left to the discretion of the organization in order to maximize flexibility in developing security 

assessment plans when applying the results of risk assessments in determining the extent, rigor, 

and level of intensity of the assessments. 

While flexibility continues to be an important factor in developing security assessment plans, 

consistency of assessments is also an important consideration. A major design objective for 

NIST Special Publication 800-53A is to provide an assessment framework and initial starting 

point for assessment procedures that are essential for achieving such consistency. In addition to 

the assessment framework and initial starting point for assessment procedures, NIST initiated the 

Assessment Case Development Project. The purpose of the project is threefold: (i) to actively 

engage experienced assessors from multiple organizations in the development of exemplary sets 

of assessment cases corresponding to the assessment procedures in Special Publication 800-53A; 

(ii) to provide organizations and the assessors supporting those organizations with an exemplary 

set of assessment cases for each assessment procedure in the catalog of procedures in this 

publication; and (iii) to provide a vehicle for ongoing community-wide review and comment of 

the assessment cases to promote continuous improvement in the assessment process for more 

consistent, cost-effective security assessments of federal information systems. The Assessment 

Case Development Project is described in Appendix J. 

In addition to the above project, NIST also initiated the Information Security Automation 

Program (ISAP) and Security Content Automation Protocol (SCAP) that support and complement 

the approach for achieving consistent, cost-effective security control assessments outlined in this 

publication. The primary purpose of the ISAP/SCAP is to improve the automated application, 

verification, and reporting of commercial information technology product-specific security 

configuration settings, thereby reducing vulnerabilities when products are not configured 

properly. The ultimate objective is to achieve a direct linkage, where appropriate, of the 

assessment procedures found in NIST Special Publication 800-53A to the SCAP automated 

testing of information system mechanisms and associated security configuration settings.5

 

Finally, it should be noted that for environments with credible threat information indicating 

sophisticated, well-resourced threat agents and possible attacks against high-value targets, 

additional assurances may be required. NIST Special Publication 800-53 indicates the need for 

explicit risk acceptance or additional assurances for moderate-impact and high-impact 

information systems whenever the organization is relying on one or more security controls to 

mitigate risks from more capable threat sources. In a similar manner, NIST Special Publication 

800-53A recognizes that, for such controls, additional organizationally-derived assessment 

activities will likely be required. These additional assessment activities will include the 

assessment objectives associated with verifying the Additional Requirements Enhancing 

Moderate-impact and High-impact Information Systems in Appendix E of NIST Special 

Publication 800-53—that is, the security controls in the information system are developed in a 

manner that supports a high degree of confidence the controls are complete, consistent, and 

correct, resulting in a greater degree of trustworthiness and penetration resistance of the system. 

 

5

 SCAP will help in achieving test results that are more uniform and repeatable, automated test procedures that are 

more transparent, and greater efficiency for assessment teams. Additional details on the ISAP/SCAP initiative, as well 

as freely available SCAP reference data, can be found at the NIST website at http://nvd.nist.gov. 

PAGE xi 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

PAGE xii 

CAUTIONARY NOTES

Organizations should carefully consider the potential impacts of employing the procedures 

defined in this Special Publication when assessing the security controls in operational

information systems. Certain assessment procedures, particularly those procedures that directly 

impact the operation of hardware, software, and/or firmware components of an information 

system, may inadvertently affect the routine processing, transmission, or storage of information 

supporting critical organizational missions or business functions. For example, a key 

information system component may be taken offline for assessment purposes or a component 

may suffer a fault or failure during the assessment process. Organizations should take necessary 

precautions during security control assessment periods to ensure that organizational missions 

and business functions continue to be supported by the information system and that only 

approved impacts to operational effectiveness are caused by the assessment. 

Security controls from NIST Special Publication 800-53 have been restated in NIST Special 

Publication 800-53A for ease of reference by assessors in specifying assessment procedures for 

conducting assessments of security controls and should not be viewed as replacing or revising 

the security controls in Special Publication 800-53, which remains the definitive NIST 

recommendation for employing security controls in federal information systems. 

Unless otherwise stated, all references to NIST publications in this document (i.e., Federal 

Information Processing Standards and Special Publications) are to the most recent version of the 

referenced publication. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

PAGE xiii 

Table of Contents 

CHAPTER ONE INTRODUCTION ..................................................................................................... 1

1.1 PURPOSE AND APPLICABILITY ....................................................................................................................... 1

1.2 TARGET AUDIENCE ...................................................................................................................................... 3

1.3 RELATIONSHIP TO OTHER ASSESSMENT PROCESSES AND PUBLICATIONS ........................................................... 3

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION................................................................................................ 4

CHAPTER TWO THE FUNDAMENTALS ........................................................................................... 6

2.1 ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE ........................................................................ 6

2.2 STRATEGY FOR CONDUCTING SECURITY CONTROL ASSESSMENTS..................................................................... 6

2.3 BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................................... 8

2.4 ASSESSMENT PROCEDURES ......................................................................................................................... 8

2.5 EXTENDED ASSESSMENT PROCEDURE ..........................................................................................................13

CHAPTER THREE THE PROCESS ................................................................................................. 14

3.1 PREPARING FOR SECURITY CONTROL ASSESSMENTS......................................................................................14

3.2 DEVELOPING SECURITY ASSESSMENT PLANS.................................................................................................16

3.3 CONDUCTING SECURITY CONTROL ASSESSMENTS..........................................................................................23

3.4 ANALYZING SECURITY ASSESSMENT REPORT RESULTS ...................................................................................25

APPENDIX A REFERENCES.........................................................................................................A-1

APPENDIX B GLOSSARY.............................................................................................................B-1

APPENDIX C ACRONYMS ............................................................................................................C-1

APPENDIX D ASSESSMENT METHOD DESCRIPTIONS ................................................................D-1

APPENDIX E ASSESSMENT EXPECTATIONS...............................................................................E-1

APPENDIX F ASSESSMENT PROCEDURE CATALOG ..................................................................F-1

APPENDIX G PENETRATION TESTING........................................................................................ G-1

APPENDIX H ASSESSMENT PROCEDURE WORK SHEET ............................................................H-1

APPENDIX I SECURITY ASSESSMENT REPORTS ........................................................................ I-1

APPENDIX J ASSESSMENT CASES ............................................................................................. J-1
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER ONE

INTRODUCTION

THE NEED TO ASSESS SECURITY CONTROL EFFECTIVENESS IN INFORMATION SYSTEMS 

oday’s information systems6 are incredibly complex assemblages of technology (including 

hardware, software, and firmware), processes, and people, all working together to provide 

organizations with the capability to process, store, and transmit information on a timely 

basis to support various organizational missions and business functions. The degree to which 

organizations have come to depend upon these information systems to conduct routine and 

critical missions and business functions means that the protection of the underlying systems is 

paramount to the success of the organization. The selection of appropriate security controls for 

an information system is an important task that can have major implications on the operations and 

assets of an organization as well as the welfare of individuals.7

 Security controls are the 

management, operational, and technical safeguards or countermeasures prescribed for an 

information system to protect the confidentiality, integrity (including non-repudiation and 

authenticity), and availability of the system and its information. Once employed within an 

information system, security controls are assessed to provide the information necessary to 

determine their overall effectiveness; that is, the extent to which the controls are implemented 

correctly, operating as intended, and producing the desired outcome with respect to meeting the 

security requirements for the system. Understanding the overall effectiveness of the security 

controls implemented in the information system is essential in determining the risk to the 

organization’s operations and assets, to individuals, to other organizations, and to the Nation 

resulting from the use of the system. 

T 

1.1 PURPOSE AND APPLICABILITY

The purpose of this publication is to provide guidelines for building effective security assessment 

plans and a comprehensive set of procedures for assessing the effectiveness of security controls 

employed in information systems supporting the executive agencies of the federal government. 

The guidelines apply to the security controls defined in NIST Special Publication 800-53 (as 

amended), Recommended Security Controls for Federal Information Systems, and any additional 

security controls developed by the organization. The guidelines have been developed to help 

achieve more secure information systems within the federal government by: 

• Enabling more consistent, comparable, and repeatable assessments of security controls; 

• Facilitating more cost-effective assessments of security controls contributing to the 

determination of overall control effectiveness; 

• Promoting a better understanding of the risks to organizational operations, organizational 

assets, individuals, other organizations, and the Nation resulting from the operation and use 

of federal information systems; and 

• Creating more complete, reliable, and trustworthy information for organizational officials—to 

support security accreditation decisions, information sharing, and FISMA compliance. 

 

6

 An information system is a discrete set of information resources organized expressly for the collection, processing, 

maintenance, use, sharing, dissemination, or disposition of information. 

7

 When selecting security controls for an information system, the organization also considers potential impacts to other 

organizations and, in accordance with the USA PATRIOT Act of 2001 and Homeland Security Presidential Directives, 

potential national-level impacts. 

CHAPTER 1 PAGE 1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

The guidelines provided in this special publication are applicable to all federal information 

systems other than those systems designated as national security systems as defined in 44 U.S.C., 

Section 3542. The guidelines have been broadly developed from a technical perspective to 

complement similar guidelines for national security systems and may be used for such systems 

with the approval of the Director of National Intelligence (DNI), the Secretary of Defense 

(SECDEF), or the Chairman of the Committee on National Security Systems (CNSS), or their 

designees. State, local, and tribal governments, as well as private sector organizations that 

compose the critical infrastructure of the United States, are also encouraged to consider the use of 

these guidelines, as appropriate. 

Organizations should use as a minimum, NIST Special Publication 800-53A in conjunction with 

an approved information system security plan in developing a viable security assessment plan for 

producing and compiling the information necessary to determine the effectiveness of the security 

controls employed in the information system. This publication has been developed with the 

intention of enabling organizations to tailor and supplement the basic assessment procedures 

provided. The assessment procedures should be used as a starting point for and as input to the 

security assessment plan. In developing effective security assessment plans, organizations should 

take into consideration existing information about the security controls to be assessed (e.g., 

results from organizational assessments of risk, platform-specific dependencies in the hardware, 

software, or firmware,8

 and any assessment procedures needed as a result of organization-specific 

controls not included in NIST Special Publication 800-53).

The selection of appropriate assessment procedures for a particular information system depends 

on three factors: 

• The security categorization of the information system in accordance with FIPS 199, 

Standards for Security Categorization of Federal Information and Information Systems, and 

NIST Special Publication 800-60, Guide for Mapping Types of Information and Information 

Systems to Security Categories; 

• The security controls identified in the approved information system security plan, including 

those from NIST Special Publication 800-53 (as amended) and any organization-specific 

controls;9

 and 

• The level of assurance that the organization must have in determining the effectiveness of the 

security controls in the information system. 

The extent of security control assessments should always be risk-driven. Organizations should 

determine the most cost-effective implementation of this key element in the organization’s 

information security program by applying the results of risk assessments, considering the 

maturity and quality level of the organization’s risk management processes, and taking advantage 

of the flexibility in NIST Special Publication 800-53A. The use of Special Publication 800-53A 

as a starting point in the process of defining procedures for assessing the security controls in 

information systems, promotes a more consistent level of security within the organization and 

offers the needed flexibility to customize the assessment based on organizational policies and 

 

8

 For example, detailed test scripts may need to be developed for the specific operating system, network component, 

middleware, or application employed within the information system to adequately assess certain characteristics of a 

particular security control. Such test scripts are at a lower level of detail than provided by the assessment procedures 

contained in Appendix F (Assessment Procedures Catalog) and are therefore beyond the scope of this publication. 

9

 The set of agreed-upon security controls for the information system are documented in the system security plan after 

the initial selection and supplementation of the controls as described in NIST Special Publication 800-53. The security 

plan is approved by appropriate organizational officials prior to the start of the security control assessment. 

CHAPTER 1 PAGE 2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

requirements, known threat and vulnerability information, operational considerations, information 

system and platform dependencies, and tolerance for risk.10 Ultimately, organizations should 

view assessment as an information gathering activity, not a security producing activity.11 

Therefore, organizations should make the final determination on the extent of security control 

assessments, to include the level of effort and resources expended during those assessments, on 

the basis of what will most cost-effectively confirm or determine whether the information system 

security requirements have been met. 

1.2 TARGET AUDIENCE 

This publication is intended to serve a diverse group of information system and information 

security professionals including: 

• Individuals with information system and security control assessment and monitoring 

responsibilities (e.g., system evaluators, assessors/assessment teams, certification 

agents/certification teams, independent verification and validation assessors, auditors, 

inspectors general, information system owners); 

• Individuals with information system and security management and oversight responsibilities 

(e.g., authorizing officials, senior agency information security officers, information security 

managers); 

• Individuals with information security implementation and operational responsibilities (e.g., 

information system owners, mission/information owners, and information system security 

officers); and 

• Individuals with information system development and integration responsibilities (e.g., 

program managers, information technology product developers, information system 

developers, systems integrators). 

1.3 RELATIONSHIP TO OTHER ASSESSMENT PROCESSES AND PUBLICATIONS

NIST Special Publication 800-53A has been designed to be used with NIST Special Publication 

800-37, Guide for the Security Certification and Accreditation of Federal Information Systems. 

In particular, the assessment procedures contained in this publication and the guidelines provided 

for developing security assessment plans for organizational information systems directly support 

the security certification and continuous monitoring phases in the four-phase certification and 

accreditation process. The primary objective of the security certification phase is to help 

determine if the security controls in the information system are effective in their application (i.e., 

implemented correctly, operating as intended, and producing the desired outcome with respect to 

meeting the security requirements of the system). The security assessment procedures defined in 

this publication provide a foundational level of assessment to support the security certification 

process. As the information system moves into the continuous monitoring phase (subsequent to 

system authorization during the security accreditation phase), organizations can select an 

appropriate subset of the assessment procedures from the security assessment plan to assess the 

 

10 In this publication, the term risk is used to mean risk to organizational operations (i.e., mission, functions, image, and 

reputation), organizational assets, individuals, other organizations, and the Nation. 

11 The information produced during security control assessments can be used by an organization to: (i) identify 

potential problems or shortfalls in the organization’s implementation of the Risk Management Framework; (ii) identify 

information system weaknesses and deficiencies; (iii) prioritize risk mitigation decisions and associated risk mitigation 

activities; (iv) confirm that identified weaknesses and deficiencies in the system have been addressed; (v) support 

information system authorization (security accreditation) decisions; and (vi) support budgetary decisions and the capital 

investment process. 

CHAPTER 1 PAGE 3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

security controls on an ongoing basis. The procedures selected for the follow-on assessments that 

occur during the continuous monitoring phase are based on the organization’s risk assessment, the 

plan of action and milestones for the information system, and organizational security policies, any 

of which may indicate the need for greater emphasis on assessment of selected security controls. 

Organizations are encouraged, whenever possible, to take advantage of the assessment results and 

associated assessment-related documentation and evidence available on information system 

components from previous assessments including independent third-party testing, evaluation, and 

validation.12 Product testing, evaluation, and validation are routinely conducted today on 

cryptographic modules and general-purpose information technology products such as operating 

systems, database systems, firewalls, intrusion detection devices, web browsers, web applications, 

smart cards, biometrics devices, personal identity verification devices, web applications, network 

devices, and hardware platforms using national and international standards. If an information 

system component product is identified as providing support for the implementation of a 

particular security control in NIST Special Publication 800-53, then any available evidence 

produced during the product testing, evaluation, and validation processes (e.g., security 

specifications, analyses and test results, validation reports, and validation certificates)13 should be 

used to the extent that it is applicable. This evidence should be combined with the assessmentrelated evidence obtained from the application of the assessment procedures in this publication, to 

cost-effectively produce the information necessary to determine whether the security controls are 

effective or ineffective in their application. 

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows: 

• Chapter Two describes the fundamental concepts associated with security control 

assessments including: (i) the integration of assessments into the system development life 

cycle; (ii) the importance of an organization-wide strategy for conducting security control 

assessments; (iii) the development of effective assurance cases; (iv) the format and content of 

assessment procedures; and (v) the use of an extended assessment procedure to help increase 

the grounds for confidence in the effectiveness of the security controls being assessed. 

• Chapter Three describes the process of assessing the security controls in organizational 

information systems including: (i) the activities carried out by organizations and assessors to 

prepare for security control assessments; (ii) the development of security assessment plans; 

(iii) the conduct of security control assessments and the analysis, documentation, and 

reporting of assessment results; and (iv) post-assessment report analysis and follow-on 

activities carried out by organizations. 

 

12 Assessment results can be obtained from many activities that occur routinely during the System Development Life 

Cycle processes within organizations. For example, assessment results are produced during the testing and evaluation 

of new information system components during system upgrades or system integration activities. Organizations should 

take advantage of previous assessment results whenever possible, to reduce the overall cost of assessments and to make 

the assessment process more efficient. 

13 Organizations should review the component product’s available information to determine: (i) what security controls 

are implemented by the product; (ii) if those security controls meet intended control requirements of the information 

system under assessment; (iii) if the configuration of the product and the environment in which the product operates are 

consistent with the environmental and product configuration as stated by the vendor/developer; and (iv) if the assurance 

requirements stated in the developer/vendor specification satisfies the assurance requirements for assessing those 

controls. Meeting the above criteria provides a sound rationale that the product is suitable and meets the intended 

security control requirements of the information system under assessment. 

CHAPTER 1 PAGE 4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER 1 PAGE 5 

• Supporting appendices provide detailed assessment-related information including: (i) 

general references; (ii) definitions and terms; (iii) acronyms; (iv) a description of assessment 

methods; (v) assessment expectations for low-impact, moderate-impact, and high-impact 

information systems; (vi) a master catalog of assessment procedures that can be used to 

develop plans for assessing security controls; (vii) penetration testing guidelines; (viii) an 

assessment procedure work sheet; (ix) a sample format for security assessment reports; and 

(x) the use of exemplary assessment cases. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER TWO

THE FUNDAMENTALS

BASIC CONCEPTS ASSOCIATED WITH SECURITY CONTROL ASSESSMENTS 

his chapter describes the basic concepts associated with assessing the security controls in 

organizational information systems including: (i) the integration of assessments into the 

system development life cycle; (ii) the importance of an organization-wide strategy for 

conducting security control assessments; (iii) the development of effective assurance cases; (iv) 

the format and content of assessment procedures; and (v) the use of an extended assessment 

procedure to help increase the grounds for confidence in the effectiveness of the security controls 

being assessed. 

T 

2.1 ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE

Security assessments can be effectively carried out at various stages in the system development 

life cycle14 to increase the grounds for confidence or assurance that the security controls 

employed with an information system are effective in their application. This publication provides 

a comprehensive set of assessment procedures to draw upon for supporting security assessment 

activities during the system development life cycle. For example, security assessments can be 

conducted by information system developers and by system integrators during the system 

development and acquisition phase of the life cycle to help ensure that the security controls 

required for the protection of the system are properly designed, developed, and implemented. 

This assessment process is often referred to as developmental security testing and evaluation 

(ST&E). The assessment procedures described in Appendix F can assist in developing ST&E 

procedures that can be employed during the initial stages of the system development life cycle. 

Security assessments can also be conducted by information system owners, security officers, 

independent certification agents, auditors, and inspectors general during the operations and 

maintenance phase of the life cycle to help ensure that the security controls are effective in the 

operational environment where the system is deployed. Finally, at the end of the life cycle, 

security assessments can be conducted as part of ensuring, for example, that important 

organizational information is purged from the information system prior to disposal. 

2.2 STRATEGY FOR CONDUCTING SECURITY CONTROL ASSESSMENTS

Organizations are encouraged to develop a broad-based, organization-wide strategy for 

conducting security assessments, facilitating more cost-effective and consistent assessments 

across the inventory of information systems. An organization-wide strategy begins by applying 

the initial steps of the Risk Management Framework15 to all information systems within the 

organization, with an organizational view of the security categorization process, the security 

control selection process, and the identification of common security controls. Maximizing the 

number of common controls employed within an organization: (i) significantly reduces the cost of 

 

14 There are five phases in the system development life cycle: (i) system initiation; (ii) system acquisition/development; 

(iii) system implementation; (iv) system operations and maintenance; and (v) system disposition (disposal). NIST 

Special Publications 800-64 and 800-100 provide guidance on integrating information security activities into the 

specific phases of the system development life cycle. 

15 The Risk Management Framework is described in NIST Special Publication 800-39 (Initial Public Draft) and consists 

of an eight-step process to ensure the development and implementation of comprehensive information security 

programs for organizations. Security control assessments are addressed in the assess and monitor steps of the 

framework.

CHAPTER 2 PAGE 6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

development, implementation, and assessment of security controls; (ii) allows organizations to 

centralize security control assessments and to amortize the cost of those assessments across all 

information systems organization-wide; and (iii) increases overall security control consistency. 

An aggressive, organization-wide approach to identifying common controls early in the Risk 

Management Framework process facilitates a more global strategy for assessing those controls 

and sharing essential assessment results with information system owners and authorizing 

officials. The sharing of assessment results among key officials across information system 

boundaries has many important benefits including: 

• Providing the capability to review assessment results for all information systems and to make 

organization-wide, mission/business-related decisions on risk mitigation activities according 

to organizational priorities, organizational assessments of risk, and the impact levels of the 

information systems supporting the organization; 

• Providing a more global view of systemic weaknesses and deficiencies occurring in 

information systems across the organization; 

• Providing an opportunity to develop organization-wide solutions to information security 

problems; and 

• Increasing the organization’s knowledge base regarding threats, vulnerabilities, and strategies 

for more cost-effective solutions to common information security problems. 

Figure 1 illustrates the relationship among the independent information system assessments and 

the overall determination and acceptance of mission/business risk. 

MISSION / BUSINESS RISK

Organization-wide View 

OPERATIONS, ASSETS, INDIVIDUALS

Organization-wide 

view of security 

with respect to 

core mission 

requirements and 

key operational 

responsibilities. 

Identification of 

systemic security 

weaknesses or 

vulnerabilities; 

development of 

organization-wide 

security solutions. 

FIGURE 1. INFORMATION SYSTEM ASSESSMENTS AND MISSION RISK 

While the conduct of the security control assessment is the primary responsibility of the 

information system owner16 with oversight by the authorizing official, there should be significant 

involvement in the assessment process by other parties within the organization who have a vested 

interest in the outcome of the assessment. Other interested parties include, for example, mission 

and information owners (when those roles are filled by someone other than the information 

system owner) and information security officials. It is imperative that the information system 

owner coordinate with the other parties in the organization having an interest in the security 

control assessment to ensure that the organization’s core missions and business functions are 

adequately addressed in the selection of security controls to be assessed. 

 

16 The information system owner is the organizational official responsible for the overall procurement, development, 

integration, modification, or operation and maintenance of an information system. 

Local View 

INFORMATION 

SYSTEM #1

Local View Local View 

INFORMATION 

SYSTEM #2

INFORMATION 

SYSTEM #3

CHAPTER 2 PAGE 7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

2.3 BUILDING AN EFFECTIVE ASSURANCE CASE

Building an effective assurance case17 for security control effectiveness is a process that involves: 

(i) compiling evidence that the controls employed in the information system are implemented 

correctly, operating as intended, and producing the desired outcome with respect to meeting the 

security requirements of the system; and (ii) presenting this evidence in a manner that decision 

makers are able to use effectively in making credible, risk-based decisions about the operation or 

use of the system. The evidence described above comes from both the implementation of the 

security controls in the information system and from the assessments of that implementation. 

Ideally, the assessor is adding to an existing assurance case that started with the specification of 

the organization’s information security needs and was further developed during the design, 

development, and implementation of the information system. 

Assessors obtain the evidence needed during the assessment process to allow the appropriate 

organizational officials to make objective determinations about the effectiveness of the security 

controls and the security of the information system. The assessment evidence needed to make 

such determinations can be obtained from a variety of sources including, but not limited to, 

information technology product and system assessments. Product assessments (also known as 

product testing and evaluation) are typically conducted by independent, third-party testing 

organizations and examine the security functions of products and established configuration 

settings. Assessments can be conducted against industry, national, and international information 

security standards as well as developer and vendor claims. Since many information technology 

products are assessed by commercial testing organizations and then subsequently deployed in 

millions of information systems, these types of assessments can be carried out at a greater level of 

depth and provide deeper insights into the security capabilities of the particular products. 

System assessments are typically conducted by information systems developers, systems 

integrators, certification agents, information system owners, auditors, inspectors general, and the 

information security staffs of organizations. These assessors or assessment teams bring together 

available information about the information system such as the results from product-level 

assessments, if available, and conduct additional system-level assessments using a variety of 

methods and techniques. System assessments are used to compile and evaluate the evidence 

needed by organizational officials to determine how effective the security controls employed in 

the information system are likely to be in mitigating risks to organizational operations and assets, 

to individuals, to other organizations, and to the Nation. The results from assessments conducted 

using information system-specific and organization-specific assessment procedures derived from 

the guidelines in NIST Special Publication 800-53A contribute to compiling the necessary 

evidence to determine security control effectiveness in accordance with the stated assurance 

requirements in the information system security plan (see NIST Special Publication 800-53, 

Appendix E, Minimum Assurance Requirements). 

2.4 ASSESSMENT PROCEDURES

An assessment procedure consists of a set of assessment objectives, each with an associated set of 

assessment methods and assessment objects. An assessment objective includes a set of 

determination statements related to the particular security control18 under assessment. The 

 

17 An assurance case is a body of evidence organized into an argument demonstrating that some claim about an 

information system holds (i.e., is assured). An assurance case is needed when it is important to show that a system 

exhibits some complex property such as safety, security, or reliability. Additional information can be obtained at 

https://buildsecurityin.us-cert.gov/daisy/bsi/articles/knowledge/assurance/643.html. 

18 References to security controls under assessment also include control enhancements. 

CHAPTER 2 PAGE 8 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

determination statements are closely linked to the content of the security control (i.e., the security 

control functionality) and the assurance requirements in NIST Special Publication 800-53 to 

ensure traceability of assessment results back to the fundamental control requirements. The 

application of an assessment procedure to a security control produces assessment findings. These 

assessment findings are subsequently used in helping to determine the overall effectiveness of the 

security control. 

The assessment objects identify the specific items being assessed and include specifications, 

mechanisms, activities, and individuals. Specifications are the document-based artifacts (e.g., 

policies, procedures, plans, system security requirements, functional specifications, and 

architectural designs) associated with an information system. Mechanisms are the specific 

hardware, software, or firmware safeguards and countermeasures employed within an information 

system.19 Activities are the specific protection-related pursuits or actions supporting an 

information system that involve people (e.g., conducting system backup operations, monitoring 

network traffic, exercising a contingency plan). Individuals, or groups of individuals, are people 

applying the specifications, mechanisms, or activities described above. 

The assessment methods define the nature of the assessor actions and include examine, interview, 

and test. The examine method is the process of reviewing, inspecting, observing, studying, or 

analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities). The 

purpose of the examine method is to facilitate assessor understanding, achieve clarification, or 

obtain evidence. The interview method is the process of conducting discussions with individuals 

or groups of individuals within an organization to once again, facilitate assessor understanding, 

achieve clarification, or obtain evidence. The test method is the process of exercising one or 

more assessment objects (i.e., activities or mechanisms) under specified conditions to compare 

actual with expected behavior. In all three assessment methods, the results are used in making 

specific determinations called for in the determination statements and thereby achieving the 

objectives for the assessment procedure. 

Each of the assessment methods described above has a set of associated attributes, depth and 

coverage, which help define the expected level of effort for the assessment. These attributes are 

hierarchical in nature, providing the means to define the rigor and scope of the assessment for the 

increased assurance needed for higher impact level information systems (see Table E-2, 

Appendix E). The depth attribute addresses the rigor of and level of detail in the examination, 

interview, and testing processes. Values for the depth attribute include generalized, focused, and 

detailed. The coverage attribute addresses the scope or breadth of the examination, interview, 

and testing processes including the number and type of specifications, mechanisms, and activities 

to be examined or tested and the number and types of individuals to be interviewed. Values for 

the coverage attribute include representative, specific, and comprehensive. Appendix D provides 

attribute definitions and descriptions of each assessment method. 

The selection of appropriate values for the depth and coverage attributes associated with a 

particular assessment method is based on the information system impact level where the security 

control under assessment is employed. Each of the information system impact levels (i.e., low, 

moderate, and high) defined in NIST Special Publication 800-53 has an associated set of 

minimum assurance requirements. The assurance requirements are directed at security control 

 

19 Mechanisms also include physical protection devices associated with an information system (e.g., locks, keypads, 

security cameras, fire protection devices, fireproof safes, etc.). 

CHAPTER 2 PAGE 9 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

developers and implementers.20 Based on the assurance requirements, security control 

developers and implementers carry out required activities and thereby, as an inherent part of 

developing or implementing the control, produce the necessary control documentation, cond

essential analyses, and define actions that must be performed during control operation. The 

purpose of these activities is to provide increased grounds for confidence that the security 

controls are implemented correctly, operating as intended, and producing the desired outcome 

with respect to meeting the security requirements for the information system. Assessors 

subsequently use the information from these developer and implementer activities during the 

assessment process to help build the assurance case that the security controls are effective 

21

uct 

in their 

application.

. 

, 

ssors 

le 1 provides a summary of the assessment expectations by 

information system impact level. 

TABLE 1: ASSESSMENT EXPECTATIONS BY INFORMATION

The minimum assurance requirements in NIST Special Publication 800-53 also help to establish 

an appropriate set of expectations for assessors in the conduct of the security control assessments

The assessment expectations, described with respect to low-impact, moderate-impact, and highimpact information systems for a range of assessment objects including specifications, activities

and mechanisms, are provided in Appendix E. The assessment expectations provide asse

with important reference points as to what findings obtained from the application of the 

assessment procedures are acceptable for subsequent use by the organization in determining 

security control effectiveness. Tab

SYSTEM IMPACT LEVEL 

INFORMATION SYSTEM IMPACT LEVEL

ASSESSMENT EXPECTATIONS

LOW MODERATE HIGH

Security controls are in place with no obvious errors. √ √ √

Increased grounds for confidence that the security controls are --- √ √

implemented correctly and operating as intended. 

Further increased grounds for confidence that the security controls are 

implemented correctly and operating as intended on an ongoing and 

consistent basis, and that there is support for continuous improvement 

--- --- √

in the effectiveness of the control. 

Grounds for a high degree of confidence that the security controls are 

Beyond minimum recommendations of NIST Special Publication 800-53A

--- 

s against highvalue targets.

complete, consistent, and correct. 

For environments with specific 

and credible threat information

indicating sophisticated, wellresourced threat agents and 

possible attack

 

20 In this context, a developer/implementer is an individual or group of individuals responsible for the development or 

implementation of security controls within an information system. This may include, for example, hardware and 

software vendors providing the controls, contractors implementing the controls, or organizational personnel such as 

information system owners, information system security officers, system and network administrators, or other 

individuals with security responsibility for the information system. 

21 For example, the assurance requirements in NIST Special Publication 800-53 at the moderate-impact level are 

designed to ensure that security controls within the information system contain specific actions and the assignment of 

responsibilities to provide increased grounds for confidence that the controls are implemented correctly and operating 

as intended. At the high-impact level, the assurance requirements are designed to ensure that when security controls 

are implemented, the controls will continuously and consistently (i.e., across the information system) meet their 

required function or purpose and support improvement in the effectiveness of the controls. These requirements are 

reflected in the associated security control assessment procedures at the appropriate impact level of the information 

system under assessment. 

CHAPTER 2 PAGE 10 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

AN EXAMPLE ASSESSMENT PROCEDURE

The following example illustrates an assessment procedure for security control CP-1. The 

assessment procedure includes a set of assessment objectives derived from the basic security 

control statement and a set of potential assessment methods and objects that can be used to make 

the determinations that lead to achieving the assessment objectives. 

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a formal, 

documented, contingency planning policy that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; and (ii) 

formal, documented procedures to facilitate the implementation of the contingency planning policy and 

associated contingency planning controls. 

Supplemental Guidance: The contingency planning policy and procedures are consistent with applicable 

laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contingency 

planning policy can be included as part of the general information security policy for the organization. 

Contingency planning procedures can be developed for the security program in general, and for a 

particular information system, when required. NIST Special Publication 800-34 provides guidance on 

contingency planning. NIST Special Publication 800-12 provides guidance on security policies and 

procedures.

CP-1 CONTINGENCY PLANNING POLICY AND PROCEDURES

Given the above requirements for security control CP-1, the assessment objectives are expressed 

as follows: 

ASSESSMENT OBJECTIVE #1

Determine if: 

(i) the organization develops and documents contingency planning policy and procedures; 

(ii) the organization disseminates contingency planning policy and procedures to appropriate 

elements within the organization; 

(iii) responsible parties within the organization periodically review contingency planning policy and 

procedures; and 

(iv) the organization updates contingency planning policy and procedures when organizational 

review indicates updates are required. 

ASSESSMENT OBJECTIVE #2

Determine if: 

(i) the contingency planning policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

(ii) the contingency planning policy is consistent with the organization’s mission and functions and 

with applicable laws, directives, policies, regulations, standards, and guidance; and 

(iii) the contingency planning procedures address all areas identified in the contingency planning 

policy and address achieving policy-compliant implementations of all associated security 

controls. 

In addition to specifying the assessment objectives, the potential assessment methods and 

assessment objects are identified.22 The depth and coverage attributes associated with the 

 

22 Whereas the assessment methods that are likely to be used have been included in the catalog of assessment 

procedures in Appendix F, these are not necessarily intended to be mandatory or exclusive and, depending on the 

particular circumstances of the information system to be assessed, not all methods may be required or other assessment 

methods may also be used. Additionally, the assessment objects listed are not intended to be a mandatory set, but 

rather a set from which the necessary and sufficient set of objects for a given assessment can be selected. 

CHAPTER 2 PAGE 11 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

assessment methods are implicit according to the impact level of the information system where 

the security controls are employed and assessed. Therefore, the expected level of effort expended 

by assessors in assessing a particular security control (i.e., the intensity and extent of the 

assessment activities) will vary based upon the impact level of the information system and the 

associated depth and coverage attributes. Appendix E provides more detailed information on 

assessment expectations and the values for depth and coverage attributes for each information 

system impact level. A complete assessment procedure for security control CP-1 consists of two 

assessment objectives23 and associated methods and objects as follows: 

CP-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents contingency planning policy and 

procedures; 

(ii) the organization disseminates contingency planning policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review contingency planning 

policy and procedures; and 

(iv) the organization updates contingency planning policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy and procedures; other relevant documents or 

records]. 

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities].

CP-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency planning policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the contingency planning policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the contingency planning procedures address all areas identified in the contingency 

planning policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy and procedures; other relevant documents or 

records]. 

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities].

The assessment objectives within a particular assessment procedure are numbered sequentially 

(e.g., CP-1.1, CP-1.2 ,..., CP-1.n). If the security control has any enhancements, assessment 

objectives are developed for each enhancement using the same process as for the base control. 

 

23 In the CP-1 example above, the control requirements are divided among two assessment objectives primarily because 

the elements within the security control are of two types—actions (first objective) and adequacy (second objective). 

However, an assessment procedure consisting of one objective covering all control requirements would also be 

acceptable. The number of objectives is kept as small as possible while still providing a meaningful subdivision of 

assessment results and providing for any needed differentiation between objectives and assessment methods that apply. 

CHAPTER 2 PAGE 12 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER 2 PAGE 13 

The resulting assessment objectives within the assessment procedure are numbered sequentially 

(e.g., CP-2(1).1 indicating the first assessment objective for the first enhancement for security 

control CP-2). 

2.5 EXTENDED ASSESSMENT PROCEDURE

In addition to the assessment procedures that are applied to individual security controls as in the 

CP-1 example above, an extended assessment procedure is applied to the assessment as a whole. 

The extended assessment procedure is designed to work with and complement the assessment 

procedures listed in Appendix F to contribute to the grounds for confidence in the effectiveness of 

the security controls employed in the information system. The extended assessment procedure 

and the associated assessment objectives are also closely linked to the impact level of the 

information system and the assurance requirements in NIST Special Publication 800-53. 

Consider the NIST Special Publication 800-53 assurance requirements for low-impact systems: 

Assurance Requirement: The security control is in effect and meets explicitly identified 

functional requirements in the control statement.

Supplemental Guidance: For security controls in low-impact information systems, the focus is on the 

controls being in place with the expectation that no obvious errors exist and that, as flaws are 

discovered, they are addressed in a timely manner. 

The basic assurance requirement for low-impact systems (i.e., security controls are in effect and 

meet explicitly identified functional requirements in the control statements) is covered by the 

assessment procedures for the security controls (see Appendix F, Section I). However, an 

additional assurance requirement for low-impact systems is identified in the supplemental 

guidance (i.e., as flaws are discovered, they are addressed in a timely manner). This additional 

assurance requirement is covered by the extended assessment procedure (see Appendix F, Section 

II). Specifically, for a low-impact information system, the following section of the extended 

assessment procedure, EAP.1, is applied: 

EAP.1 ASSESSMENT OBJECTIVE:

Determine if the organization has a process in place to address in a timely manner, any 

flaws discovered in the implementation or application of the security controls in the 

information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, documents, activities, or mechanisms related 

to addressing flaws in security controls or control enhancements]. 

The extended assessment procedure applies to the entire assessment, yet may be implemented 

control by control, by group of controls, or collectively across all controls in the information 

system simultaneously. In this situation, the organization, based on the information system 

security plan for implementing the NIST Special Publication 800-53 assurance requirements, may 

have decided to have a process in place to address flaws at the individual security control level 

(e.g., CP-1) or may have decided to rely on a single process to document and address flaws at the 

security control family level (e.g., Contingency Planning family). Extending that concept further, 

the organization may have also decided to employ an organization-wide process to document 

flaws in the security controls across the entire information system. Whether the organization 

chooses to implement one process or many processes will determine how the assessor applies the 

extended assessment procedure. The specific application of the extended assessment procedure 

should be described in the security assessment plan. See Appendix F for the complete extended 

assessment procedure. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER THREE

THE PROCESS

CONDUCTING EFFECTIVE SECURITY CONTROL ASSESSMENTS 

his chapter describes the process of assessing the security controls in organizational 

information systems including: (i) the activities carried out by organizations and assessors 

to prepare for security control assessments; (ii) the development of security assessment 

plans; (iii) the conduct of security control assessments and the analysis, documentation, and 

reporting of assessment results; and (iv) post-assessment report analysis and follow-on activities 

carried out by organizations. 

T 

3.1 PREPARING FOR SECURITY CONTROL ASSESSMENTS 

Conducting security control assessments in today’s complex environment of sophisticated 

information technology infrastructures and high-visibility, mission-critical applications can be 

difficult, challenging, and resource-intensive. Success requires the cooperation and collaboration 

among all parties having a vested interest in the organization’s information security posture, 

including information system owners, authorizing officials, chief information officers, senior 

agency information security officers, chief executive officers/heads of agencies, inspectors 

general, and the OMB. Establishing an appropriate set of expectations before, during, and after 

the assessment is paramount to achieving an acceptable outcome—that is, producing information 

necessary to help the authorizing official make a credible, risk-based decision on whether to place 

the information system into operation or continue its operation. 

Thorough preparation by the organization and the assessors is an important aspect of conducting 

effective security control assessments. Preparatory activities should address a range of issues 

relating to the cost, schedule, and performance of the assessment. From the organizational 

perspective, preparing for a security control assessment includes the following key activities: 

• Ensuring that appropriate policies covering security control assessments are in place and 

understood by all organizational elements; 

• Ensuring that all steps in the NIST Risk Management Framework prior to the security control 

assessment step, have been successfully completed and received appropriate management 

oversight;24

• Ensuring that security controls identified as common controls (and the common portion of 

hybrid controls) have been assigned to appropriate organizational entities for development 

and implementation;25

 

24 The steps in the Risk Management Framework include the development of a security plan that has been reviewed for 

completeness and correctness, approved by appropriate organizational officials, and used as the basis for defining the 

security controls that have been implemented in the information system. 

25 The security control assessment may include common controls that are the responsibility of organizational entities 

other than the information system owner or hybrid controls where there is shared responsibility among the system 

owner and designated organizational entities. However, within the context of a given information system, it is 

anticipated that the need for status of common controls will be primarily satisfied upon determination that a specific 

organizational entity has responsibility for that common control (or the common portion of a hybrid control). In most 

cases, the management and oversight for common controls is expected to be at a higher-level within an organization 

than for a specific information system, therefore, limiting the accountability of a system authorizing official with regard 

to common controls. 

CHAPTER 3 PAGE 14 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

• Establishing the objective and scope of the security control assessment (i.e., the purpose of 

the assessment and what is being assessed); 

• Notifying key organizational officials of the impending security control assessment and 

allocating necessary resources to carry out the assessment; 

• Establishing appropriate communication channels among organizational officials having an 

interest in the security control assessment;26

• Establishing time frames for completing the security control assessment and key milestone 

decision points required by the organization to effectively manage the assessment; 

• Identifying and selecting a competent assessor/assessment team that will be responsible for 

conducting the security control assessment, considering issues of assessor independence; 

• Collecting artifacts to provide to the assessor/assessment team (e.g., policies, procedures, 

plans, specifications, designs, records, administrator/operator manuals, information system 

documentation, interconnection agreements, previous assessment results); and 

• Establishing a mechanism between the organization and the assessor and/or assessment team 

to minimize ambiguities or misunderstandings about security control implementation or 

security control weaknesses/deficiencies identified during the assessment. 

In addition to the planning activities the organization carries out in preparation for the security 

control assessment, assessors/assessment teams should begin preparing for the assessment by: 

• Obtaining a general understanding of the organization’s operations (including mission, 

functions, and business processes) and how the information system that is the subject of the 

security control assessment supports those organizational operations; 

• Obtaining an understanding of the structure of the information system (i.e., system 

architecture); 

• Obtaining a thorough understanding of the security controls being assessed (including 

system-specific, hybrid, and common controls) together with appropriate FIPS and NIST 

Special Publications that are referenced in those controls; 

• Identifying the organizational entities responsible for the development and implementation of 

the common security controls (or the common portion of hybrid controls) supporting the 

information system; 

• Establishing appropriate organizational points of contact needed to carry out the security 

control assessment; 

• Obtaining artifacts needed for the security control assessment (e.g., policies, procedures, 

plans, specifications, designs, records, administrator/operator manuals, information system 

documentation, interconnection agreements, previous assessment results); 

• Obtaining previous assessment results that may be appropriately reused for the security 

control assessment (e.g., IG reports, audits, vulnerability scans, physical security inspections; 

developmental testing and evaluation). 

 

26 Typically, these individuals include authorizing officials, information system owners, mission and information 

owners (if other than the information system owner), chief information officers, senior agency information security 

officers, inspectors general, information system security officers, users from organizations that the information system 

supports, and assessors (e.g., certification agents/teams, independent auditors). 

CHAPTER 3 PAGE 15 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

• Meeting with appropriate organizational officials to ensure common understanding for 

assessment objectives and the proposed rigor and scope of the assessment; and 

• Developing a security assessment plan. 

In preparation for the assessment of security controls, the necessary background information 

should be assembled and made available to the assessors or assessment team.27 To the extent 

necessary to support the specific assessment, the organization should identify and arrange access 

to: (i) elements of the organization responsible for developing, documenting, disseminating, 

reviewing, and updating all security policies and associated procedures for implementing policycompliant controls; (ii) the security policies for the information system and any associated 

implementing procedures; (iii) individuals or groups responsible for the development, 

implementation, operation, and maintenance of security controls; (iv) any materials (e.g., security 

plans, records, schedules, assessment reports, after-action reports, agreements, accreditation 

packages) associated with the implementation and operation of security controls; and (v) the 

objects to be assessed.28 The availability of essential documentation as well as access to key 

organizational personnel and the information system being assessed are paramount to a successful 

assessment of the security controls. 

3.2 DEVELOPING SECURITY ASSESSMENT PLANS

The security assessment plan provides the objectives for the security control assessment and a 

detailed roadmap of how to conduct such an assessment. The output and end result of the 

security control assessment is the security assessment report, which documents the assurance 

case for the information system and is one of three key documents in the security accreditation 

package developed by information system owners for authorizing officials.29 The security 

assessment report includes information from the assessor (in the form of assessment findings) 

necessary to determine the effectiveness of the security controls employed in the information 

system and the organization’s overall effectiveness determination based upon the assessor’s 

findings. The security assessment report is a key factor in the authorizing official’s determination 

of risk to organizational operations (i.e., mission, functions, image, or reputation), organizational 

assets, individuals, other organizations, and the Nation. Appendix I provides additional 

information on the format and content of security assessment reports. 

The following steps should be considered by assessors in developing plans to assess the security 

controls in organizational information systems: (i) determine the type of security control 

assessment (e.g., complete or partial assessment); (ii) determine which security controls and 

control enhancements are to be included in the assessment; (iii) select the appropriate assessment 

procedures to be used during the assessment based on the security controls and control 

enhancements in the system security plan; (iv) tailor the selected assessment procedures for the 

information system impact level and organization’s operating environment; (v) develop additional 

assessment procedures, if necessary, to address security controls and control enhancements that 

 

27 Information system owners and organizational entities developing, implementing, and/or administering common 

security controls are responsible for providing as much information as possible to assessors/assessment teams to ensure 

their success. 

28 In situations where there are multiple security control assessments ongoing or planned within an organization, access 

to organizational elements, individuals, and artifacts supporting the assessments should be centrally managed by the 

organization to ensure a cost-effective use of time and resources. 

29 In accordance with NIST Special Publication 800-37, the security accreditation package consists of the security plan 

(including the risk assessment), the security assessment report, and the plan of action and milestones (POAM). 

CHAPTER 3 PAGE 16 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

are not contained in NIST Special Publication 800-53 or to address additional assurance needs 

beyond what is provided in NIST Special Publication 800-53A; (vi) develop a strategy to apply 

the extended assessment procedure; (vii) optimize the assessment procedures to reduce 

duplication of effort and provide cost-effective assessment solutions; and (viii) finalize the 

assessment plan and obtain the necessary approvals to execute the plan. 

3.2.1 Determine which security controls are to be assessed. 

The security plan provides an overview of the security requirements for the information system 

and describes the security controls in place or planned for meeting those requirements. The 

assessor starts with the security controls described in the security plan and considers the purpose 

of the assessment. A security control assessment can be a complete assessment of all security 

controls in the information system (e.g., the certification phase of the certification and 

accreditation process) or a partial assessment of the security controls in the information system 

(e.g., the continuous monitoring phase of the certification and accreditation process where subsets 

of the controls in the information system are assessed on an ongoing basis). For partial 

assessments, the information system owner collaborates with organizational officials having an 

interest in the assessment (e.g., senior agency information security officer, mission/information 

owners, inspectors general, and authorizing official) to determine which security controls from 

the system security plan are to be assessed. Selection of the security controls depends on the 

continuous monitoring schedule established by the system owner to ensure that all controls are 

assessed during the three-year accreditation cycle, items on the plan of action and milestones 

receive adequate oversight, and controls with greater volatility are assessed more frequently.30 

3.2.2 Select the appropriate procedures to assess the security controls. 

NIST Special Publication 800-53A, Appendix F, provides an assessment procedure for each 

security control and control enhancement in NIST Special Publication 800-53. For each security 

control and control enhancement in the system security plan to be assessed during the assessment, 

assessors select the corresponding assessment procedure from Appendix F. The set of selected 

assessment procedures varies from assessment to assessment based on the current content of the 

system security plan and on the purpose of the organization’s security assessment (e.g., security 

certification, continuous monitoring). Appendix H provides a work sheet for selecting the 

appropriate assessment procedures for the assessment based on the approved security plan and the 

particular assessment focus. 

3.2.3 Tailor the assessment procedures for specific operating environments. 

In a similar manner to how the security controls from NIST Special Publication 800-53 are 

tailored for the organization’s mission, business functions, characteristics of the information 

system and operating environment, the assessment procedures listed in Appendix F are tailored to 

meet specific organizational needs. Assessment procedures can be tailored by: (i) selecting the 

assessment objects needed to make appropriate determinations and to satisfy assessment 

objectives; (ii) applying assessment method depth and coverage attribute values in accordance 

with the assigned information system impact level; (iii) eliminating assessment procedures for 

common security controls if those controls have been assessed by another documented 

assessment process; (iv) developing information system/platform-specific and organizationspecific assessment procedure adaptations to successfully carry out the assessment of the security 

 

30 Section 3.4 provides further information on selecting security controls in an information system to be assessed as part 

of a continuous monitoring process. In addition, NIST Special Publication 800-37 provides guidance on continuous 

monitoring as part of the security certification and accreditation process. 

CHAPTER 3 PAGE 17 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

controls; (v) incorporating assessment results from previous assessments where the results are 

applicable; (vi) choosing the appropriate assessment methods based on the impact level of the 

information system where the security controls are employed; and (vii) making appropriate 

adjustments in assessment procedures to be able to obtain the requisite assessment evidence from 

external providers. 

Assessment object-related considerations— 

Recognizing that organizations can specify, organize, document, and configure their information 

systems in a variety of ways, the assessment objects identified in Appendix F that are used in 

conjunction with the interview, examine, and test methods should be considered potential objects 

where information/evidence may be found. As such, assessors are expected to use their judgment 

in applying the designated assessment methods to the associated set of assessment objects. Each 

assessment method listed in an assessment procedure should be applied to a sufficient number of 

assessment objects to produce the information necessary to make the determination in the 

determination statement and to satisfy the assessment objective. It may not always be necessary 

to apply each assessment method to every assessment object in the list. 

Depth- and coverage-related considerations— 

Each assessment method used in an assessment procedure contains both depth and coverage 

attributes. The attributes, described in Appendix D, are directly linked to the impact level of the 

information system under assessment as indicated in Appendix E. The attribute values are 

assigned based on information system impact level and affect the extent, rigor, and intensity of 

the assessment procedure executed by the assessor.31 For example, for low-impact information 

systems, the attribute values assigned to the depth and coverage attributes respectively, are 

generalized and representative. This means that, in this example for a low-impact system, as 

assessors carry out the assessment procedures for the security controls and control enhancements 

in the security plan including conducting interviews with individuals, examining policies, 

procedures, and other documentation, and testing portions of the information system, the level of 

effort is guided by the definitions in Appendix D for generalized depth and representative 

coverage. 

Common security control-related considerations— 

Assessors should note which security controls (or parts of controls) in the information system 

security plan are designated as common controls. Since the assessment of common controls is the 

responsibility of the organizational entity that developed and implemented the controls, the 

assessment procedures in Appendix F used to assess these controls should incorporate assessment 

results from that organizational entity.32 Common controls may have been previously assessed as 

part of the organization’s information security program, or there may be a separate plan to assess 

 

31 In addition to overall information system impact level, the potential exists for some controls, or aspects of a control, 

to be implemented within system components (e.g., separately identified subsystems) that represent a lower potential 

for impact than the system as a whole. For the portion of the assessment related to such components, selected depth 

and coverage values can correspond to the lower potential impact, thereby achieving a more cost-effective assessment. 

32 Common security controls support multiple information systems within the organization and the protection measures 

provided by those controls are inherited by the individual systems under assessment. Therefore, the organization 

should determine the FIPS 199 impact level associated with the designated common controls to ensure that both the 

strength of the controls (i.e., security capability) and level rigor and intensity of the control assessments are 

commensurate with the impact level of the individual information systems inheriting those controls. In general, the 

impact level associated with the organization’s common controls should support the highest impact level of any 

individual information system within the organization relying on those controls. 

CHAPTER 3 PAGE 18 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

the common controls.33 In either situation, the information system owner coordinates the 

assessment of all security controls in the information system with appropriate organizational 

officials (e.g., chief information officer, senior agency information security officer, mission/ 

information owners, authorizing official) obtaining the results of common control assessments or 

(if the common controls have not been assessed or are due to be reassessed) making the necessary 

arrangements to include the common control assessment results in the current assessment.34

Another consideration in assessing common security controls is that there are occasionally 

system-specific aspects of a common control that are not covered by the organizational entities 

responsible for the common aspects of the control. These types of security controls are referred 

to as hybrid controls. For example, CP-2, the contingency planning security control, may be 

deemed a hybrid control by the organization if there is a master contingency plan developed by 

the organization for all organizational information systems. However, information system 

owners are expected to adjust, tailor, or supplement the contingency plan as necessary, when 

there are system-specific aspects of the plan that need to be defined for the particular information 

system where the control is employed. For each hybrid security control, assessors should include 

in the assessment plan, the portions of the assessment procedures from Appendix F related to the 

parts of the control that are system-specific to ensure that, along with the results from common 

control assessments, all aspects of the security control are assessed. 

System/platform and organization-related considerations— 

The assessment procedures in NIST Special Publication 800-53A may be adapted to address 

system/platform-specific or organization-specific dependencies. This situation arises frequently 

in the assessment procedures associated with the security controls from the technical families in 

NIST Special Publication 800-53 (i.e., access control, audit and accountability, identification and 

authentication, system and communications protection). For example, an extension to the IA-2 

control for identification and authentication of users might include an explicit examination of the 

.rhosts file for UNIX systems since improper entries in that file can result in bypassing user 

authentication. Recent test results may also be applicable to the current assessment if those test 

methods provide a high degree of transparency (e.g., what was tested, when was it tested, how 

was it tested). Standards-based testing protocols such as the Security Content Automation 

Protocol (SCAP) provide an example of how organizations can help achieve this level of 

transparency. Further, the SCAP checklists and test procedures are organized by NIST Special 

Publication 800-53 controls to enable efficiency in assessing federal information systems. 

Additional information on the ISAP/SCAP initiative can be found at the NIST website at 

http://nvd.nist.gov. 

Reuse of assessment evidence-related considerations— 

In general, assessors should take advantage of existing security control assessment information to 

facilitate more cost-effective assessments. The reuse of assessment results from previously 

accepted or approved assessments of the information system should be considered in the body of 

 

33 If common control assessment results for moderate-impact and high-impact information systems are to be used for 

certification activities, then an independent assessment (or independent validation of assessment results) must be 

conducted and the authorizing official has the right to determine the acceptable degree of assessor independence. 

34 If assessment results are not currently available for the common controls, the assessment plans for the information 

systems under assessment that depend on those controls should be duly noted. The assessments cannot be considered 

complete until the assessment results for the common controls are made available to information system owners. NIST 

Special Publications 800-37 and 800-53 provide guidance on the employment and use of common security controls in 

organizational information systems. 

CHAPTER 3 PAGE 19 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

evidence for determining overall security control effectiveness.35 The assessment procedures 

presented in Appendix F are designed to gather or compile evidence for determining if security 

controls are implemented correctly, operating as intended, and producing the desired outcome 

with regard to meeting the security requirements of the information system. When considering 

the reuse of assessment results from previous assessments, assessors should validate the 

credibility of the evidence obtained, the appropriateness of previous analysis, and the 

applicability of the evidence to present information system operating conditions.36 It may be 

necessary, in certain situations, to supplement the previous assessment results under consideration 

for reuse with additional assessment activities to fully address the assessment objectives. For 

example, if an independent, third-party evaluation of an information technology product did not 

test a particular configuration setting that is used by the organization to help protect the 

information system, then the assessor may need to supplement the original test results with 

additional testing to cover that configuration setting for the current information system 

environment. The following items should be considered in validating previous assessment results 

for reuse in the current assessment: 

- Changing conditions associated with security controls over time. 

Security controls that were deemed effective during previous assessments may have become 

ineffective due to changing conditions within the information system or the surrounding 

environment. Thus, assessment results that were found to be previously acceptable may no 

longer provide credible evidence for determination of security control effectiveness, and a 

reassessment would be required. Applying previous assessment results to a current 

assessment requires the identification of any changes that have occurred since the previous 

assessment and the impact of these changes on the previous assessment results. For example, 

reusing previous assessment results that involved examining an organization’s security 

policies and procedures may be acceptable if it is determined that there have not been any 

significant changes to the identified policies and procedures. Reusing evidence and security 

control assessment results produced during the initial certification and accreditation of an 

information system will likely be a cost-effective method for supporting continuous 

monitoring activities and annual FISMA reporting when the related controls have not changed 

and there are adequate reasons for confidence in their continued application. 

- The acceptability of using previous assessments.

The acceptability of using previous assessment results in a security control assessment should 

be coordinated with and approved by the users of the assessment results. It is essential that the 

information system owner collaborates with appropriate organizational officials (e.g., chief 

information officer, senior agency information security officer, mission/information owners, 

authorizing official) in determining the acceptability of using previous assessment results. 

The decision to reuse assessment results should be documented in the security assessment plan 

and the final security assessment report and should be consistent with federal legislation, 

policies, directives, standards, and guidelines with respect to the security control assessments. 

 

35 Previously accepted or approved assessments include those assessments of common security controls that are 

managed by the organization and support multiple information systems. 

36 For example, it should be noted that information technology product assessments are based upon the assumption that 

the products are properly and appropriately configured when installed in particular information systems in specific 

operational environments. If not properly configured, the products may not perform in the manner verified during the 

assessment. 

CHAPTER 3 PAGE 20 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

- The amount of time that has transpired since the previous assessments. 

In general, as the time period between current and previous assessments increases, the 

credibility/utility of the previous assessment results decreases. This is primarily due to the 

fact that the information system or the environment in which the information system operates 

is more likely to change with the passage of time, possibly invalidating the original conditions 

or assumptions on which the previous assessment was based. 

- The degree of independence of the previous assessments.

Assessor independence can be a critical factor in certain types of assessments, especially for 

information system at the moderate- and high-impact levels. The degree of independence 

required from assessment to assessment should be consistent. For example, it is not 

appropriate to reuse results from a previous self-assessment where no assessor independence 

was required, in a current assessment requiring a greater degree of independence. 

Information system impact level-related considerations— 

For those security controls and control enhancements contained in the three security control 

baselines in NIST Special Publication 800-53, a suggested application of the assessment methods 

to a low-impact, moderate-impact, and high-impact information system assessment is provided in 

the assessment procedures in Appendix F by the designators (L), (M), or(H) respectively. These 

designations are intended to assist, not limit, assessors in the selection of the most cost-effective 

assessment methods and are provided for the set of security controls and control enhancements 

most often used and with regard to the impact level(s) with which they will most commonly be 

applied. For example, a security control in the low baseline is also in the moderate and high 

baselines, and for such controls, a suggestion is provided as to which assessment methods to 

apply based on whether the control is being used in a low-impact, moderate-impact, or highimpact system. For security controls or control enhancements in the moderate or high baselines, 

but not in the low baseline, suggested applicability is provided only with regard to use in 

moderate-impact or high-impact systems. 

External information system-related considerations 

The assessment procedures in Appendix F need to be adjusted as appropriate to accommodate the 

assessment of external information systems.37 Because the organization does not always have 

direct control over the security controls used in external information systems, or sufficient 

visibility into the development, implementation, and assessment of those controls, alternative 

assessment approaches may need to be applied, resulting in the need to tailor the assessment 

procedures described in Appendix F. Where required assurances of agreed-upon security controls 

for an information system are documented in contracts or service-level agreements, the assessor 

should review these contracts or agreements and where appropriate, tailor the assessment 

procedures to assess either the security controls or the security control assessment results 

provided through these agreements. Additionally, assessors should take into account any 

assessments that have been conducted, or are in the process of being conducted, for external 

information systems that are relied upon with regard to protecting the information system under 

assessment. Applicable information from these assessments, if deemed reliable, should be 

incorporated into the security assessment report.

 

37 An external information system is an information system or component of an information system that is outside of 

the accreditation boundary established by the organization and for which the organization typically has no direct 

control over the application of required security controls or the assessment of security control effectiveness. NIST 

Special Publications 800-39 and 800-53 provide additional guidance on external information systems and the effect of 

employing security controls in those types of environments. 

CHAPTER 3 PAGE 21 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

3.2.4 Develop assessment procedures for organization-specific security controls. 

Based on organizational policies, mission or business function requirements, and an assessment 

of risk, organizations may choose to develop and implement additional (organization-specific) 

security controls or control enhancements for their information systems that are beyond the scope 

of FIPS 200 and NIST Special Publication 800-53. Such security controls are documented in the 

security plan for the information system as controls not found in Special Publication 800-53. To 

assess the security controls in this situation, assessors should use the material described in 

Chapter Two to develop assessment procedures for those controls and control enhancements. The 

assessment procedures developed should be integrated into the security assessment plan. 

3.2.5 Develop assessment procedures for additional assurance requirements. 

The assessment procedures described in NIST Special Publication 800-53A correspond with the 

minimum assurance requirements identified in NIST Special Publication 800-53. However, when 

the organization is relying upon security controls to mitigate risks arising from extremely skilled, 

highly motivated, and well-financed threat sources, Special Publication 800-53 requires 

organizations obtain additional assurances for moderate-impact and high-impact information 

systems. As indicated in the last row in Table E-1 in Appendix E, the assessment procedures for 

these added assurances are beyond the scope of the minimum assessment expectations currently 

described in this document. Therefore, when such additional assurances apply, the organization 

should develop additional assessment procedures to provide the necessary evidence that the 

effected security controls have been developed in a manner that supports a high degree of 

confidence that the controls are complete, consistent, and implemented correctly. Additionally, 

organizational risk management needs may dictate the development of assessment procedures 

beyond the procedures provided in this publication. In both cases, the additional security control 

assessment procedures should be integrated into the security assessment plan. 

3.2.6 Develop strategy for incorporating the extended assessment procedure. 

Organizations have great flexibility in achieving the developer/implementer assurance 

requirements in NIST Special Publication 800-53. For a requirement such as assurance that flaws 

are addressed in a timely manner, the organization can satisfy this requirement on a control-bycontrol basis, on a by-type-of-control basis, on a system-by-system basis, or perhaps even at the 

organizational level. In consideration of this flexibility, the extended assessment procedure in 

Appendix F is applied on an assessment-by-assessment basis typically according to how the 

organization chose to achieve the associated Special Publication 800-53 assurances for the 

information system under assessment. The method of application should be documented in the 

security assessment plan. Further, the organization selects the appropriate assessment objectives 

from the extended assessment procedure based on the information system impact level. The 

application of the extended assessment procedure is intended to supplement the other assessment 

procedures to increase the grounds for confidence that the security controls are implemented 

correctly, operating as intended, and producing the desired outcome with regard to meeting the 

security requirements of the information system. 

3.2.7 Optimize the selected assessment procedures to ensure maximum efficiency. 

Assessors have a great deal of flexibility in organizing a security assessment plan that meets the 

needs of the organization and that provides the best opportunity for obtaining the necessary 

evidence to determine security control effectiveness, while reducing overall assessment costs. 

Combining and consolidating assessment procedures is one area where this flexibility can be 

applied. During the assessment of an information system, assessment methods are applied 

numerous times to a variety of assessment objects within a particular family of security controls. 

CHAPTER 3 PAGE 22 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

To save time, reduce assessment costs, and maximize the usefulness of assessment results, 

assessors should review the selected assessment procedures for the security control families and 

combine or consolidate the procedures (or parts of procedures) whenever possible or practicable. 

For example, assessors may wish to consolidate interviews with key organizational officials 

dealing with a variety of security-related topics. Assessors may have other opportunities for 

significant consolidations and cost savings by examining all security policies and procedures 

from the seventeen families of security controls at the same time or organizing groups of related 

policies and procedures that would be amenable to a single, unified examination. Obtaining and 

examining configuration settings from similar hardware and software components within the 

information system is another example that can provide significant assessment efficiencies. 

An additional area for consideration in optimizing the assessment process is the sequence in 

which security controls are assessed. The assessment of some security controls before others may 

provide information that facilitates understanding and assessment of other controls. For example, 

security controls such as CM-2 (Baseline Configuration), CM-8 (Information System Component 

Inventory), PL-2 (System Security Plan), RA-2 (Security Categorization), and RA-3 (Risk 

Assessment) produce general descriptions of the information system. Assessing these security 

controls early in the assessment process may provide a basic understanding of the information 

system that can aid in assessing other security controls. The supplemental guidance of many 

security controls also identifies related controls that can provide useful information in organizing 

the assessment procedures. For example, AC-19 (Access Control for Portable and Mobile 

Devices) lists security controls MP-4 (Media Storage) and MP-5 (Media Transport) as being 

related to AC-19. Since AC-19 is related to MP-4 and MP-5, the sequence in which assessments 

are conducted for AC-19, MP-4, and MP-5 may facilitate the reuse of assessment information 

from one control in assessing other related controls. 

3.2.8 Finalize the security assessment plan and obtain approval to execute the plan. 

After selecting the assessment procedures (including developing necessary procedures not 

contained in the NIST Special Publication 800-53A catalog of procedures), tailoring the 

procedures for information system/platform-specific and organization-specific conditions, 

optimizing the procedures for efficiency, applying the extended assessment procedure, and 

addressing the potential for unexpected events impacting the assessment, the assessment plan is 

finalized and the schedule is established including key milestones for the assessment process. 

Once the security assessment plan is completed, the plan is reviewed and approved by appropriate 

organizational officials38 to ensure that the plan is complete, consistent with the security 

objectives of the organization and the organization’s assessment of risk, and cost-effective with 

regard to the resources allocated for the assessment. 

3.3 CONDUCTING SECURITY CONTROL ASSESSMENTS

After the security assessment plan is approved by the organization, the assessor or assessment 

team39 executes the plan in accordance with the agreed-upon milestones and schedule. 

Assessment objectives are achieved by applying the designated assessment methods to selected 

assessment objects and compiling/producing the information necessary to make the determination 

 

38 Organizations should establish a security assessment plan approval process with the specific organizational officials 

(e.g., information systems owners, information system security officers, senior agency information security officers, 

authorizing officials) designated as approving authorities for the security plan of the information system being assessed. 

39 Determining the size and organizational makeup of the security assessment team (i.e., skill sets, technical expertise, 

and assessment experience of the individuals composing the team) is part of the risk management decisions made by 

the organization requesting and initiating the assessment of the information system. 

CHAPTER 3 PAGE 23 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

associated with each assessment objective. Each determination statement contained within an 

assessment procedure executed by an assessor produces one the following findings: (i) satisfied 

(S); or (ii) other than satisfied (O). A finding of satisfied indicates that for the portion of the 

security control addressed by the determination statement, the assessment information obtained 

(i.e., evidence collected) indicates that the assessment objective for the control has been met 

producing a fully acceptable result. A finding of other than satisfied indicates that for the portion 

of the security control addressed by the determination statement, the assessment information 

obtained indicates potential anomalies in the operation or implementation of the control that may 

need to be addressed by the organization. A finding of other than satisfied may also indicate that 

for reasons specified in the assessment report, the assessor was unable to obtain sufficient 

information to make the particular determination called for in the determination statement. 

The assessor findings (i.e., the determinations made) should be an unbiased, factual reporting of 

what was found concerning the security control assessed. For each finding of other than 

satisfied, assessors should indicate which parts of the security control are affected by the finding 

(i.e., those aspects of the control that were deemed not satisfied or were not able to be assessed) 

and describe how the control differs from the planned or expected state. The potential for 

compromises to confidentiality, integrity, and availability due to an other than satisfied finding 

should also be noted by the assessor.

Security control assessment results should be documented at the level of detail appropriate for the 

assessment in accordance with the reporting format prescribed by organizational policy, NIST 

guidelines, and OMB policy. The reporting format should be consistent with the type of security 

control assessment conducted (e.g., self-assessments by information system owners, independent 

verification and validation, independent assessments by assessors or assessment teams supporting 

the security accreditation process, or independent audits of security controls by auditors or 

inspectors general). A sample reporting format for security control assessments is provided in 

Appendix I. The sample reporting format is illustrative and not intended to limit organizational 

flexibility in determining the most appropriate presentation for the purposes of a given security 

control assessment. 

The information system owner relies on the security expertise and the technical judgment of the 

assessor to: (i) assess the security controls in the information system; and (ii) provide specific 

recommendations on how to correct deficiencies in the controls and reduce or eliminate identified 

vulnerabilities. The assessment information produced by the assessor (i.e., findings of satisfied or 

other than satisfied, identification of the parts of the security control that did not produce a 

satisfactory result, and a description of resulting potential for compromises to the information 

system) is provided to the information system owner in the initial (draft) security assessment 

report. The information system owner may choose to act on selected recommendations of the 

assessor before the security assessment report is finalized if there are specific opportunities to 

correct deficiencies in the security controls or to correct and/or clarify misunderstandings or 

interpretations of assessment results.40 Security controls modified, enhanced, or added during 

this process should be reassessed by the assessor prior to the production of the final secur

assessment report. The delivery of the final report to the information system owner marks the 

official end of the security control assessment. 

ity 

 

40 The correction of deficiencies in security controls or carrying out of selected assessor recommendations during the 

information system owner’s review of the initial (draft) security assessment report is not intended to replace the formal 

risk mitigation process by the organization which occurs after the delivery and acceptance of the final report. Rather, it 

provides the information system owner with an opportunity to address problems or deficiencies that may be quickly 

correctable and thereby eliminate a need for an assessor finding and subsequent organizational response. 

CHAPTER 3 PAGE 24 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

3.4 ANALYZING SECURITY ASSESSMENT REPORT RESULTS

Since results of the security control assessment ultimately influence the content of the system 

security plan and the plan of action and milestones, the information system owner reviews the 

findings of the assessor and with the concurrence of designated organizational officials (e.g., 

authorizing official, chief information officer, senior agency information security officer, 

mission/information owners), determines the appropriate steps required to correct weaknesses and 

deficiencies identified during the assessment. By using the tags of satisfied and other than 

satisfied, the reporting format for the assessment findings provides visibility for organizational 

officials into specific weaknesses and deficiencies in the information system and facilitates a 

disciplined and structured approach to mitigating risks in accordance with organizational 

priorities. 

For example, the information system owner in consultation with designated organizational 

officials may decide that certain assessment findings marked as other than satisfied are of an 

inconsequential nature and present no significant risk to the organization. Alternatively, the 

system owner and organizational officials may decide that certain findings marked as other than 

satisfied are significant, requiring immediate remediation actions. In all cases, the organization 

reviews each assessor finding of other than satisfied and applies its judgment with regard to the 

severity or seriousness of the finding (i.e., the potential adverse affect on organizational 

operations, organizational assets, individuals, other organizations, or the Nation), and whether the 

finding is significant enough to be worthy of further investigation or remedial action.

Senior leadership involvement in the mitigation process may be necessary in order to ensure that 

the organization’s resources are effectively allocated in some priority order—providing resources 

first to the information systems that are supporting the most critical and sensitive missions for the 

organization. Ultimately, the assessment findings and any subsequent mitigation actions initiated 

by the information system owner in collaboration with designated organizational officials trigger 

updates to the risk assessment and the system security plan. Therefore, the key documents used 

by the authorizing official to determine the security status of the information system (i.e., system 

security plan with updated risk assessment, security assessment report, and plan of actions and 

milestones) are updated to reflect the results of the security control assessment. 

With respect to supporting the security certification and accreditation process, the authorizing 

official relies on information provided by the information system owner (i.e., the revised risk 

assessment documented in the updated system security plan and the plan of actions and 

milestones) along with the assessment findings from the assessor (in the security assessment 

report) in arriving at a decision on the current risk posture and the acceptability of such risk. The 

authorizing official uses the results from the security control assessment as one of the critical 

inputs in helping to decide whether the information system should be authorized for operation or 

continued in an authorized status.41

 

41 Security control assessment results can also be used by authorizing officials to justify either halting or delaying the 

operation of a new or legacy information system until identified weaknesses and deficiencies have been addressed and 

associated risks mitigated. 

CHAPTER 3 PAGE 25 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

CHAPTER 3 PAGE 26 

Figure 2 provides an overview of the security control assessment process including the activities 

carried out during pre-assessment, assessment, and post-assessment. 

ASSESSOR PREPARATION 

- Establish appropriate organizational 

points of contact. 

- Understand organization’s mission, 

functions, and business processes. 

- Understand information system 

structure (i.e., system architecture). 

- Understand security controls under 

assessment and relevant NIST 

standards and guidelines. 

- Develop security assessment plan. 

- Obtain artifacts for assessment. 

SP

800-53A 

Artifacts 

ORGANIZATION PREPARATION 

- Implement the security controls in the information 

system (i.e., Step 5 in the Risk Management 

Framework). 

- Notify key organizational officials of impending 

assessment. 

- Establish and open communications channels 

among stakeholders. 

- Identify and allocate necessary assessment 

resources; assemble assessment team. 

- Establish key milestones to effectively manage 

the assessment. 

- Assemble artifacts for assessment. 

Assessment 

Process

- Assessment objectives. 

- Selected assessment 

methods and objects. 

- Procedures tailored with 

organization and system 

specific information. 

- Assessment cases for 

specific assessor actions. 

FIGURE 2: SECURITY CONTROL ASSESSMENT PROCESS OVERVIEW

- Schedule and milestones. 

Security

Assessment 

Plan 

ORGANIZATION 

APPROVAL 

- Ensure assessment 

plan is appropriately 

tailored. 

- Involve senior 

leadership. 

- Balance schedule, 

performance, cost. 

Approved 

System 

Security 

Plan 

ORGANIZATION OVERSIGHT 

- Review assessor findings. 

- Consult with organizational officials regarding security control 

effectiveness. 

- Initiate remediation actions. 

- Develop/update Plan of Action and Milestones. 

- Update System Security Plan (including Risk Assessment). 

Plan of

Action and 

Post 

Assessment 

Process 

SECURITY 

ASSESSMENT 

- Implement security 

assessment plan. 

- Execute assessment 

procedures to achieve 

assessment objectives. 

- Maintain impartiality and 

report objectively. 

- Produce assessment 

findings. 

- Recommend specific 

remediation actions (i.e., 

corrective actions or 

improvements in control 

implementation or in 

operation). 

- Produce initial (draft) and 

final security assessment 

reports. 

Security Initial draft report. Assessment 

Report Final report with 

organizational annotations.

Milestones 

System 

Security 

Plan 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX A

REFERENCES

LAWS, POLICIES, DIRECTIVES, REGULATIONS, MEMORANDA, STANDARDS, AND GUIDELINES42

LEGISLATION

1. E-Government Act [includes FISMA] (P.L. 107-347), December 2002. 

2. Federal Information Security Management Act (P.L. 107-347, Title III), December 2002. 

3. Paperwork Reduction Act (P.L. 104-13), May 1995. 

4. USA PATRIOT Act (P.L. 107-56), October 2001. 

5. Privacy Act of 1974 (P.L. 93-579), December 1974. 

POLICIES, DIRECTIVES, REGULATIONS, AND MEMORANDA

6. Code of Federal Regulations, Title 5, Administrative Personnel, Section 731.106 

Designation of Public Trust Positions and Investigative Requirements, (5 C.F.R. 731.106). 

7. Code of Federal Regulations, Part 5 Administrative Personnel, Subpart C—Employees 

Responsible for the Management or Use of Federal Computer Systems, Section 930.301 

through 930.305 (5 C.F.R 930.301-305). 

8. Office of Management and Budget, Circular A-130, Appendix III, Transmittal 

Memorandum #4, Management of Federal Information Resources, November 2000. 

9. Office of Management and Budget, Federal Enterprise Architecture Program Management 

Office, Business Reference Model (v2.0), June 2003. 

10. Office of Management and Budget Memorandum M-02-01, Guidance for Preparing and 

Submitting Security Plans of Action and Milestones, October 2001. 

11. Office of Management and Budget Memorandum M-03-19, Reporting Instructions for the 

Federal Information Security Management Act and Updated Guidance on Quarterly IT 

Security Reporting, August 2003. 

12. Office of Management and Budget Memorandum M-03-22, OMB Guidance for 

Implementing the Privacy Provisions of the E-Government Act of 2002, September 2003. 

13. Office of Management and Budget Memorandum M-04-04, E-Authentication Guidance for 

Federal Agencies, December 2003. 

14. Office of Management and Budget Memorandum M-05-24, Implementation of Homeland 

Security Presidential Directive (HSPD) 12—Policy for a Common Identification Standard 

for Federal Employees and Contractors, August 2005. 

15. Office of Management and Budget Memorandum M-06-16, Protection of Sensitive 

Information, June 2006. 

16. Office of Management and Budget Memorandum M-06-20, FY 2006 Reporting 

Instructions for the Federal Information Security Management Act and Agency Privacy 

Management, July 2006. 

 

42 The status and most current versions of NIST publications including FIPS and Special Publications in the 800-series 

(draft and final) can be found at http://csrc.nist.gov/publications. 

APPENDIX A PAGE A-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

STANDARDS

17. International Organization for Standardization/International Electrotechnical Commission 

27001, Information Security Management System Requirements, October 2005. 

18. International Organization for Standardization/International Electrotechnical Commission 

17799, Code of Practice for Information Security Management, June 2005. 

19. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 140-2, Security Requirements for Cryptographic Modules, May 2001. 

 National Institute of Standards and Technology Federal Information Processing Standards 

 Publication 140-3 (Draft), Security Requirements for Cryptographic Modules, July 2007. 

20. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 180-2, Secure Hash Standard (SHS), January 2000. 

 National Institute of Standards and Technology Federal Information Processing Standards 

 Publication 180-3 (Draft), Secure Hash Standard (SHS), June 2007. 

21. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 186-2, Digital Signature Standard (DSS), January 2000. 

 National Institute of Standards and Technology Federal Information Processing Standards 

 Publication 186-3 (Draft), Digital Signature Standard (DSS), March 2006. 

22. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 188, Standard Security Labels for Information Transfer, September 1994. 

23. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 190, Guideline for the Use of Advanced Authentication Technology 

Alternatives, September 1994. 

24. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 197, Advanced Encryption Standard (AES), November 2001. 

25. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 198-1, The Keyed-Hash Message Authentication Code (HMAC), June 2007. 

26. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 199, Standards for Security Categorization of Federal Information and 

Information Systems, February 2004. 

27. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 200, Minimum Security Requirements for Federal Information and Information 

Systems, March 2006. 

28. National Institute of Standards and Technology Federal Information Processing Standards 

Publication 201-1, Personal Identity Verification of Federal Employees and Contractors, 

March 2006. 

29. Committee for National Security Systems (CNSS) Instruction 4009, National Information 

Assurance Glossary, June 2006. 

30. National Security Telecommunications and Information Systems Security Instruction 

(NSTISSI) 7003, Protective Distribution Systems (PDS), December 1996. 

GUIDELINES

31. National Institute of Standards and Technology Special Publication 800-12, An 

Introduction to Computer Security: The NIST Handbook, October 1995. 

APPENDIX A PAGE A-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

32. National Institute of Standards and Technology Special Publication 800-13, 

Telecommunications Security Guidelines for Telecommunications Management Network, 

October 1995. 

33. National Institute of Standards and Technology Special Publication 800-14, Generally 

Accepted Principles and Practices for Securing Information Technology Systems, 

September 1996. 

34. National Institute of Standards and Technology Special Publication 800-15, Minimum 

Interoperability Specification for PKI Components (MISPC), Version 1, September 1997. 

35. National Institute of Standards and Technology Special Publication 800-16, Information 

Technology Security Training Requirements: A Role- and Performance-Based Model, 

April 1998. 

36. National Institute of Standards and Technology Special Publication 800-17, Modes of 

Operation Validation System (MOVS): Requirements and Procedures, February 1998. 

37. National Institute of Standards and Technology Special Publication 800-18, Revision 1, 

Guide for Developing Security Plans for Federal Information Systems, February 2006. 

38. National Institute of Standards and Technology Special Publication 800-19, Mobile Agent 

Security, October 1999. 

39. National Institute of Standards and Technology Special Publication 800-20, Modes of 

Operation Validation System for the Triple Data Encryption Algorithm (TMOVS): 

Requirements and Procedures, April 2000. 

40. National Institute of Standards and Technology Special Publication 800-21-1, Second 

Edition, Guideline for Implementing Cryptography in the Federal Government, December 

2005. 

41. National Institute of Standards and Technology Special Publication 800-22, A Statistical 

Test Suite for Random and Pseudorandom Number Generators for Cryptographic 

Applications, May 2001. 

42. National Institute of Standards and Technology Special Publication 800-23, Guideline to 

Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated 

Products, August 2000. 

43. National Institute of Standards and Technology Special Publication 800-24, PBX 

Vulnerability Analysis: Finding Holes in Your PBX Before Someone Else Does, August 

2000. 

44. National Institute of Standards and Technology Special Publication 800-25, Federal 

Agency Use of Public Key Technology for Digital Signatures and Authentication, October 

2000. 

45. National Institute of Standards and Technology Special Publication 800-26, Security SelfAssessment Guide for Information Technology Systems, November 2001. 

46. National Institute of Standards and Technology Special Publication 800-27, Revision A, 

Engineering Principles for Information Technology Security (A Baseline for Achieving 

Security), June 2004. 

APPENDIX A PAGE A-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

47. National Institute of Standards and Technology Special Publication 800-28, Guidelines on 

Active Content and Mobile Code, October 2001. 

 National Institute of Standards and Technology Special Publication 800-28 Version 2 

 (Draft), Guidelines on Active Content and Mobile Code, August 2007. 

48. National Institute of Standards and Technology Special Publication 800-29, A Comparison 

of the Security Requirements for Cryptographic Modules in FIPS 140-1 and FIPS 140-2, 

June 2001. 

49. National Institute of Standards and Technology Special Publication 800-30, Risk 

Management Guide for Information Technology Systems, July 2002. 

50. National Institute of Standards and Technology Special Publication 800-31, Intrusion 

Detection Systems (IDS), November 2001. 

51. National Institute of Standards and Technology Special Publication 800-32, Introduction to 

Public Key Technology and the Federal PKI Infrastructure, February 2001. 

52. National Institute of Standards and Technology Special Publication 800-33, Underlying 

Technical Models for Information Technology Security, December 2001. 

53. National Institute of Standards and Technology Special Publication 800-34, Contingency 

Planning Guide for Information Technology Systems, June 2002. 

54. National Institute of Standards and Technology Special Publication 800-35, Guide to 

Information Technology Security Services, October 2003. 

55. National Institute of Standards and Technology Special Publication 800-36, Guide to 

Selecting Information Security Products, October 2003. 

56. National Institute of Standards and Technology Special Publication 800-37, Guide for the 

Security Certification and Accreditation of Federal Information Systems, May 2004. 

57. National Institute of Standards and Technology Special Publication 800-38A, 

Recommendation for Block Cipher Modes of Operation - Methods and Techniques, 

December 2001. 

58. National Institute of Standards and Technology Special Publication 800-38B, 

Recommendation for Block Cipher Modes of Operation: The CMAC Mode for 

Authentication, May 2005. 

59. National Institute of Standards and Technology Special Publication 800-38C, 

Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication 

and Confidentiality, May 2004. 

60. National Institute of Standards and Technology Special Publication 800-38D, 

Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) for 

Confidentiality and Authentication, November 2007. 

61. National Institute of Standards and Technology Special Publication 800-39 (Initial Public 

Draft), Managing Risk from Information Systems: An Organizational Perspective, October 

2007. 

62. National Institute of Standards and Technology Special Publication 800-40, Version 2.0, 

Creating a Patch and Vulnerability Management Program, November 2005. 

63. National Institute of Standards and Technology Special Publication 800-41, Guidelines on 

Firewalls and Firewall Policy, January 2002. 

APPENDIX A PAGE A-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

64. National Institute of Standards and Technology Special Publication 800-42, Guideline on 

Network Security Testing, October 2003. 

65. National Institute of Standards and Technology Special Publication 800-43, Systems 

Administration Guidance for Windows 2000 Professional, November 2002. 

66. National Institute of Standards and Technology Special Publication 800-44, Guidelines on 

Securing Public Web Servers, September 2002. 

67. National Institute of Standards and Technology Special Publication 800-45, Guidelines on 

Electronic Mail Security (Version 2), February 2007. 

68. National Institute of Standards and Technology Special Publication 800-46, Security for 

Telecommuting and Broadband Communications, August 2002. 

69. National Institute of Standards and Technology Special Publication 800-47, Security Guide 

for Interconnecting Information Technology Systems, August 2002. 

70. National Institute of Standards and Technology Special Publication 800-48, Wireless 

Network Security: 802.11, Bluetooth, and Handheld Devices, November 2002. 

 National Institute of Standards and Technology Special Publication 800-48, Revision 1 

 (Draft), Wireless Network Security for IEEE 802.11a/b/g and Bluetooth, August 2007. 

71. National Institute of Standards and Technology Special Publication 800-49, Federal 

S/MIME V3 Client Profile, November 2002. 

72. National Institute of Standards and Technology Special Publication 800-50, Building an 

Information Technology Security Awareness and Training Program, October 2003. 

73. National Institute of Standards and Technology Special Publication 800-51, Use of the 

Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme, September 

2002. 

74. National Institute of Standards and Technology Special Publication 800-52, Guidelines for 

the Selection and Use of Transport Layer Security (TLS) Implementations, June 2005. 

75. National Institute of Standards and Technology Special Publication 800-53, Revision 1, 

Recommended Security Controls for Federal Information Systems, December 2006. 

 National Institute of Standards and Technology Special Publication 800-53, Revision 2 

 (Draft), Recommended Security Controls for Federal Information Systems, November 

 2007. 

76. National Institute of Standards and Technology Special Publication 800-54, Border 

Gateway Protocol Security, June 2007. 

77. National Institute of Standards and Technology Special Publication 800-55, Security 

Metrics Guide for Information Technology Systems, July 2003. 

 National Institute of Standards and Technology Special Publication 800-55, Revision 1 

 (Draft), Performance Measurement Guide for Information Security, September 2007. 

78. National Institute of Standards and Technology Special Publication 800-56A, 

Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm 

Cryptography (Revised), March 2007. 

79. National Institute of Standards and Technology Special Publication 800-57, 

Recommendation for Key Management, Part I: General (Revised), March 2007. 

APPENDIX A PAGE A-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

80. National Institute of Standards and Technology Special Publication 800-58, Security 

Considerations for Voice Over IP Systems, January 2005. 

81. National Institute of Standards and Technology Special Publication 800-59, Guideline for 

Identifying an Information System as a National Security System, August 2003. 

82. National Institute of Standards and Technology Special Publication 800-60, Guide for 

Mapping Types of Information and Information Systems to Security Categories, June 2004. 

 National Institute of Standards and Technology Special Publication 800-60, Revision 1 

 (Draft), Guide for Mapping Types of Information and Information Systems to Security 

 Categories, November 2007. 

83. National Institute of Standards and Technology Special Publication 800-61, Computer 

Security Incident Handling Guide, January 2004. 

 National Institute of Standards and Technology Special Publication 800-61 Revision 1 

 (Draft), Computer Security Incident Handling Guide, September 2007. 

84. National Institute of Standards and Technology Special Publication 800-63, Version 1.0.2, 

Electronic Authentication Guideline: Recommendations of the National Institute of 

Standards and Guidelines, April 2006. 

85. National Institute of Standards and Technology Special Publication 800-64, Revision 1, 

Security Considerations in the Information System Development Life Cycle, June 2004. 

86. National Institute of Standards and Technology Special Publication 800-65, Integrating 

Security into the Capital Planning and Investment Control Process, January 2005. 

87. National Institute of Standards and Technology Special Publication 800-66, An 

Introductory Resource Guide for Implementing the Health Insurance Portability and 

Accountability Act (HIPAA) Security Rule, March 2005. 

88. National Institute of Standards and Technology Special Publication 800-67, 

Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, May 

2004. 

89. National Institute of Standards and Technology Special Publication 800-68, Guidance for 

Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security 

Configuration Checklist, October 2005. 

90. National Institute of Standards and Technology Special Publication 800-69, Guidance for 

Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist, 

September 2006. 

91. National Institute of Standards and Technology Special Publication 800-70, Security 

Configuration Checklists Program for IT Products: Guidance for Checklists Users and 

Developers, May 2005. 

92. National Institute of Standards and Technology Special Publication 800-72, Guidelines on 

PDA Forensics, November 2004. 

93. National Institute of Standards and Technology Special Publication 800-73, Revision 1, 

Interfaces for Personal Identity Verification, March 2006. 

 National Institute of Standards and Technology Special Publication 800-73-2 (Draft), 

 Interfaces for Personal Identity Verification, October 2007. 

94. National Institute of Standards and Technology Special Publication 800-76-1, Biometric 

Data Specification for Personal Identity Verification, January 2007. 

APPENDIX A PAGE A-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

95. National Institute of Standards and Technology Special Publication 800-77, Guide to IPsec 

VPNs, December 2005. 

96. National Institute of Standards and Technology Special Publication 800-78, Cryptographic 

Algorithms and Key Sizes for Personal Identity Verification, April 2005. 

97. National Institute of Standards and Technology Special Publication 800-79, Guidelines for 

the Certification and Accreditation of PIV Card Issuing Organizations, July 2005. 

98. National Institute of Standards and Technology Special Publication 800-81, Secure

 Domain Name System (DNS) Deployment Guide, May 2006. 

99. National Institute of Standards and Technology Special Publication 800-82 (Second Public 

Draft), Guide to Industrial Control Systems (ICS) Security, September 2007.

100. National Institute of Standards and Technology Special Publication 800-83, Guide to

 Malware Incident Prevention and Handling, November 2005. 

101. National Institute of Standards and Technology Special Publication 800-84, Guide to

 Test, Training, and Exercise Programs for IT Plans and Capabilities, September 2006. 

102. National Institute of Standards and Technology Special Publication 800-85A, PIV

 Card Application and Middleware Interface Test Guidelines (SP 800-73 Compliance), 

 April 2006. 

103. National Institute of Standards and Technology Special Publication 800-85B, PIV

 Data Model Test Guidelines, July 2006. 

104. National Institute of Standards and Technology Special Publication 800-86, Guide to

 Integrating Forensic Techniques into Incident Response, August 2006.

105. National Institute of Standards and Technology Special Publication 800-87, Codes for

 the Identification of Federal and Federally-Assisted Organizations, March 2007. 

106. National Institute of Standards and Technology Special Publication 800-88, Guidelines

 For Media Sanitization, September 2006. 

107. National Institute of Standards and Technology Special Publication 800-89, 

 Recommendation for Obtaining Assurances for Digital Signature Applications, 

 November 2006. 

108. National Institute of Standards and Technology Special Publication 800-90, 

 Recommendation for Random Number Generation Using Deterministic Random Bit 

 Generators (Revised), March 2007. 

109. National Institute of Standards and Technology Special Publication 800-92, Guide to

 Computer Security Log Management, September 2006. 

110. National Institute of Standards and Technology Special Publication 800-94, Guide to

 Intrusion Detection and Prevention Systems (IDPS), February 2007. 

111. National Institute of Standards and Technology Special Publication 800-95, Guide to

 Secure Web Services, August 2007. 

112. National Institute of Standards and Technology Special Publication 800-96, PIV Card /

 Reader Interoperability Guidelines, September 2006. 

113. National Institute of Standards and Technology Special Publication 800-97, 

 Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i, February 

 2007. 

APPENDIX A PAGE A-7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX A PAGE A-8 

114. National Institute of Standards and Technology Special Publication 800-98, Guidelines

 for Securing Radio Frequency Identification (RFID) Systems, April 2007. 

115. National Institute of Standards and Technology Special Publication 800-100, 

 Information Security Handbook: A Guide for Managers, October 2006. 

116. National Institute of Standards and Technology Special Publication 800-101, 

 Guidelines on Cell Phone Forensics, May 2007. 

117. National Institute of Standards and Technology Special Publication 800-115, Technical

 Guide to Information Security Testing (Draft), November 2007. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX B

GLOSSARY

COMMON TERMS AND DEFINITIONS 

his appendix provides definitions for security terminology used within Special Publication 

800-53A. The terms in the glossary are consistent with the terms used in the suite of 

FISMA-related security standards and guidelines developed by NIST. Unless otherwise 

stated, all terms used in this publication are also consistent with the definitions contained in the 

CNSS Instruction 4009, National Information Assurance Glossary. 

T 

Accreditation 

[FIPS 200, NIST SP 800-37] 

The official management decision given by a senior 

agency official to authorize operation of an information 

system and to explicitly accept the risk to agency 

operations (including mission, functions, image, or 

reputation), agency assets, or individuals, based on the 

implementation of an agreed-upon set of security 

controls. 

Accreditation Boundary 

[NIST SP 800-37]

All components of an information system to be accredited 

by an authorizing official and excludes separately 

accredited systems, to which the information system is 

connected. Synonymous with the term security perimeter 

defined in CNSS Instruction 4009 and DCID 6/3. 

Accrediting Authority See Authorizing Official. 

Activities An assessment object that includes specific protectionrelated pursuits or actions supporting an information 

system that involve people (e.g., conducting system 

backup operations, monitoring network traffic). 

Adequate Security 

[OMB Circular A-130, Appendix III] 

Security commensurate with the risk and the magnitude 

of harm resulting from the loss, misuse, or unauthorized 

access to or modification of information. 

Agency See Executive Agency. 

Assessment Findings Assessment results produced by the application of an 

assessment procedure to a security control or control 

enhancement to achieve an assessment objective; the 

execution of a determination statement within an 

assessment procedure by an assessor that results in either 

a satisfied or other than satisfied condition. 

Assessment Method One of three types of actions (i.e., examine, interview, 

test) taken by assessors in obtaining evidence during an 

assessment. 

Assessment Object The item (i.e., specifications, mechanisms, activities, 

individuals) upon which an assessment method is applied 

during an assessment. 

APPENDIX B PAGE B-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Assessment Objective A set of determination statements that expresses the 

desired outcome for the assessment of a security control 

or control enhancement. 

Assessment Procedure A set of assessment objectives and an associated set of 

assessment methods and assessment objects. 

Assurance The grounds for confidence that the set of intended 

security controls in an information system are effective in 

their application.

Assurance Case 

[Software Engineering Institute, 

Carnegie Mellon University] 

A structured set of arguments and a body of evidence 

showing that an information system satisfies specific 

claims with respect to a given quality attribute. 

Authentication 

[FIPS 200]

Verifying the identity of a user, process, or device, often 

as a prerequisite to allowing access to resources in an 

information system. 

Authenticity The property of being genuine and being able to be 

verified and trusted; confidence in the validity of a 

transmission, a message, or message originator. See 

Authentication. 

Authorize Processing See Accreditation. 

Authorizing Official 

[FIPS 200, NIST SP 800-37]

Official with the authority to formally assume 

responsibility for operating an information system at an 

acceptable level of risk to agency operations (including 

mission, functions, image, or reputation), agency assets, 

or individuals. Synonymous with Accreditation 

Authority. 

Availability 

[44 U.S.C., Sec. 3542] 

Ensuring timely and reliable access to and use of 

information. 

Black Box Testing See Generalized Testing. 

Boundary Protection Monitoring and control of communications at the external 

boundary of an information system to prevent and detect 

malicious and other unauthorized communications, 

through the use of boundary protection devices (e.g., 

proxies, gateways, routers, firewalls, guards, encrypted 

tunnels). 

Boundary Protection Device A device with appropriate mechanisms that: (i) facilitates 

the adjudication of different interconnected system 

security policies (e.g., controlling the flow of information 

into or out of an interconnected system); and/or (ii) 

monitors and controls communications at the external 

boundary of an information system to prevent and detect 

malicious and other unauthorized communications. 

Boundary protection devices include such components as 

proxies, gateways, routers, firewalls, guards, and 

encrypted tunnels. 

APPENDIX B PAGE B-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Certification 

[FIPS 200, NIST SP 800-37]

A comprehensive assessment of the management, 

operational, and technical security controls in an 

information system, made in support of security 

accreditation, to determine the extent to which the 

controls are implemented correctly, operating as 

intended, and producing the desired outcome with respect 

to meeting the security requirements for the system. 

Certification Agent 

[NIST SP 800-37]

The individual, group, or organization responsible for 

conducting a security certification. 

Chief Information Officer 

[PL 104-106, Sec. 5125(b)]

Agency official responsible for: 

(i) Providing advice and other assistance to the head of 

the executive agency and other senior management 

personnel of the agency to ensure that information 

technology is acquired and information resources are 

managed in a manner that is consistent with laws, 

Executive Orders, directives, policies, regulations, and 

priorities established by the head of the agency; 

(ii) Developing, maintaining, and facilitating the 

implementation of a sound and integrated information 

technology architecture for the agency; and 

(iii) Promoting the effective and efficient design and 

operation of all major information resources management 

processes for the agency, including improvements to 

work processes of the agency.

Common Security Control 

[NIST SP 800-37]

Security control that can be applied to one or more 

agency information systems and has the following 

properties: (i) the development, implementation, and 

assessment of the control can be assigned to a responsible 

official or organizational element (other than the 

information system owner); and (ii) the results from the 

assessment of the control can be used to support the 

security certification and accreditation processes of an 

agency information system where that control has been 

applied. 

Compensating Security Controls The management, operational, and technical controls 

(i.e., safeguards or countermeasures) employed by an 

organization in lieu of the recommended controls in the 

low, moderate, or high baselines described in NIST 

Special Publication 800-53, that provide equivalent or 

comparable protection for an information system. 

Confidentiality 

[44 U.S.C., Sec. 3542] 

Preserving authorized restrictions on information access 

and disclosure, including means for protecting personal 

privacy and proprietary information. 

Configuration Control 

[CNSS Inst. 4009] 

Process for controlling modifications to hardware, 

firmware, software, and documentation to protect the 

information system against improper modifications 

before, during, and after system implementation. 

APPENDIX B PAGE B-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Countermeasures 

[CNSS Inst. 4009] 

Actions, devices, procedures, techniques, or other 

measures that reduce the vulnerability of an information 

system. Synonymous with security controls and 

safeguards. 

Controlled Area Any area or space for which the organization has 

confidence that the physical and procedural protections 

provided are sufficient to meet the requirements 

established for protecting the information and/or 

information system. 

Coverage An attribute associated with an assessment method that 

addresses the scope or breadth of the assessment objects 

included in the assessment (e.g., types of objects to be 

assessed and the number of objects to be assessed by 

type). The values for the coverage attribute, 

hierarchically from less to more coverage, are 

representative, specific, and comprehensive. 

Depth An attribute associated with an assessment method that 

addresses the rigor and level of detail associated with the 

application of the method. The values for the depth 

attribute, hierarchically from less depth to more depth, 

are generalized, focused, and detailed. 

Detailed Testing A test methodology that assumes explicit and substantial 

knowledge of the internal structure and implementation 

detail of the assessment object. Also known as white box 

testing. 

Examine A type of assessment method that is characterized by the 

process of checking, inspecting, reviewing, observing, 

studying, or analyzing one or more assessment objects to 

facilitate understanding, achieve clarification, or obtain 

evidence, the results of which are used to support the 

determination of security control effectiveness over time. 

Executive Agency 

[41 U.S.C., Sec. 403] 

An executive department specified in 5 U.S.C., Sec. 101; 

a military department specified in 5 U.S.C., Sec. 102; an 

independent establishment as defined in 5 U.S.C., Sec. 

104(1); and a wholly owned Government corporation 

fully subject to the provisions of 31 U.S.C., Chapter 91. 

Extended Assessment Procedure A type of assessment procedure that is applied to an 

individual security control or a group of controls (e.g., the 

set of security controls in a particular security control 

family or the set of controls in an information system 

security plan) and is used in conjunction with other 

assessment procedures in providing the necessary 

information for determining control effectiveness.

APPENDIX B PAGE B-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

External Information System (or 

Component) 

An information system or component of an information 

system that is outside of the accreditation boundary 

established by the organization and for which the 

organization typically has no direct control over the 

application of required security controls or the 

assessment of security control effectiveness. 

External Information System 

Service 

An information system service that is implemented 

outside of the accreditation boundary of the 

organizational information system (i.e., a service that is 

used by, but not a part of, the organizational information 

system). 

External Information System 

Service Provider 

A provider of external information system services to an 

organization through a variety of consumer-producer 

relationships, including but not limited to: joint ventures; 

business partnerships; outsourcing arrangements (i.e., 

through contracts, interagency agreements, lines of 

business arrangements); licensing agreements; and/or 

supply chain exchanges. 

Federal Enterprise Architecture 

[FEA Program Management Office]

A business-based framework for governmentwide 

improvement developed by the Office of Management 

and Budget that is intended to facilitate efforts to 

transform the federal government to one that is citizencentered, results-oriented, and market-based. 

Federal Information 

System 

[40 U.S.C., Sec. 11331] 

An information system used or operated by an executive 

agency, by a contractor of an executive agency, or by 

another organization on behalf of an executive agency. 

Focused Testing A test methodology that assumes some knowledge of the 

internal structure and implementation detail of the 

assessment object. Also known as gray box testing. 

Generalized Testing A test methodology that assumes no knowledge of the 

internal structure and implementation detail of the 

assessment object. Also known as black box testing. 

Gray Box Testing See Focused Testing. 

High-Impact System 

[FIPS 200]

An information system in which at least one security 

objective (i.e., confidentiality, integrity, or availability) is 

assigned a FIPS 199 potential impact value of high. 

Hybrid Security Control 

[NIST SP 800-53]

Security control for an information system where one part 

of the control is deemed to be common, while another 

part of the control is deemed to be system-specific. 

Incident 

[FIPS 200] 

An occurrence that actually or potentially jeopardizes the 

confidentiality, integrity, or availability of an information 

system or the information the system processes, stores, or 

transmits or that constitutes a violation or imminent threat 

of violation of security policies, security procedures, or 

acceptable use policies. 

APPENDIX B PAGE B-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Individuals An assessment object that includes people applying 

specifications, mechanisms, or activities. 

Industrial Control System An information system used to control industrial 

processes such as manufacturing, product handling, 

production, and distribution. Industrial control systems 

include supervisory control and data acquisition systems 

used to control geographically dispersed assets, as well as 

distributed control systems and smaller control systems 

using programmable logic controllers to control localized 

processes. 

Information 

[FIPS 199] 

An instance of an information type. 

Information Owner 

[CNSS Inst. 4009] 

Official with statutory or operational authority for 

specified information and responsibility for establishing 

the controls for its generation, collection, processing, 

dissemination, and disposal. 

Information Resources 

[44 U.S.C., Sec. 3502] 

Information and related resources, such as personnel, 

equipment, funds, and information technology. 

Information Security 

[44 U.S.C., Sec. 3542] 

The protection of information and information systems 

from unauthorized access, use, disclosure, disruption, 

modification, or destruction in order to provide 

confidentiality, integrity, and availability. 

Information Security 

Policy 

[CNSS Inst. 4009] 

Aggregate of directives, regulations, rules, and practices 

that prescribes how an organization manages, protects, 

and distributes information. 

Information System 

[44 U.S.C., Sec. 3502] 

[OMB Circular A-130, Appendix III] 

A discrete set of information resources organized for the 

collection, processing, maintenance, use, sharing, 

dissemination, or disposition of information. 

Information System Owner 

(or Program Manager) 

[CNSS Inst. 4009, Adapted] 

Official responsible for the overall procurement, 

development, integration, modification, or operation and 

maintenance of an information system. 

Information System 

Security Officer 

[CNSS Inst. 4009, Adapted] 

Individual assigned responsibility by the senior agency 

information security officer, authorizing official, 

management official, or information system owner for 

maintaining the appropriate operational security posture 

for an information system or program. 

APPENDIX B PAGE B-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Information Technology 

[40 U.S.C., Sec. 1401] 

Any equipment or interconnected system or subsystem of 

equipment that is used in the automatic acquisition, 

storage, manipulation, management, movement, control, 

display, switching, interchange, transmission, or 

reception of data or information by the executive agency. 

For purposes of the preceding sentence, equipment is 

used by an executive agency if the equipment is used by 

the executive agency directly or is used by a contractor 

under a contract with the executive agency which: (i) 

requires the use of such equipment; or (ii) requires the 

use, to a significant extent, of such equipment in the 

performance of a service or the furnishing of a product. 

The term information technology includes computers, 

ancillary equipment, software, firmware, and similar 

procedures, services (including support services), and 

related resources. 

Information Type 

[FIPS 199] 

A specific category of information (e.g., privacy, 

medical, proprietary, financial, investigative, contractor 

sensitive, security management) defined by an 

organization or in some instances, by a specific law, 

Executive Order, directive, policy, or regulation. 

Integrity 

[44 U.S.C., Sec. 3542] 

Guarding against improper information modification or 

destruction, and includes ensuring information nonrepudiation and authenticity. 

Interview A type of assessment method that is characterized by the 

process of conducting discussions with individuals or 

groups within an organization to facilitate understanding, 

achieve clarification, or lead to the location of evidence, 

the results of which are used to support the determination 

of security control effectiveness over time. 

Label See Security Label. 

Local Access Access to an organizational information system by a user 

(or an information system) communicating through an 

internal organization-controlled network (e.g., local area 

network) or directly to a device without the use of a 

network. 

Low-Impact System 

[FIPS 200]

An information system in which all three security 

objectives (i.e., confidentiality, integrity, and availability) 

are assigned a FIPS 199 potential impact value of low. 

Major Information System 

[OMB Circular A-130] 

An information system that requires special management 

attention because of its importance to an agency mission; 

its high development, operating, or maintenance costs; or 

its significant role in the administration of agency 

programs, finances, property, or other resources. 

APPENDIX B PAGE B-7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Malicious Code 

[CNSS Inst. 4009] 

[NIST SP 800-61]

Software or firmware intended to perform an 

unauthorized process that will have adverse impact on the 

confidentiality, integrity, or availability of an information 

system. A virus, worm, Trojan horse, or other codebased entity that infects a host. Spyware and some forms 

of adware are also examples of malicious code. 

Malware See Malicious Code. 

Management Controls 

[FIPS 200] 

The security controls (i.e., safeguards or 

countermeasures) for an information system that focus on 

the management of risk and the management of 

information system security. 

Mechanisms An assessment object that includes specific protectionrelated items (e.g., hardware, software, or firmware) 

employed within or at the boundary of an information 

system. 

Media 

[FIPS 200] 

Physical devices or writing surfaces including, but not 

limited to, magnetic tapes, optical disks, magnetic disks, 

Large-Scale Integration (LSI) memory chips, and 

printouts (but not including display media) onto which 

information is recorded, stored, or printed within an 

information system. 

Media Access Control Address A hardware address that uniquely identifies each 

component of an IEEE 802-based network. On networks 

that do not conform to the IEEE 802 standards but do 

conform to the OSI Reference Model, the node address is 

called the Data Link Control (DLC) address. 

Media Sanitization 

[NIST SP 800-88]

A general term referring to the actions taken to render 

data written on media unrecoverable by both ordinary and 

extraordinary means. 

Mobile Code Software programs or parts of programs obtained from 

remote information systems, transmitted across a 

network, and executed on a local information system 

without explicit installation or execution by the recipient. 

Mobile Code Technologies Software technologies that provide the mechanisms for 

the production and use of mobile code (e.g., Java, 

JavaScript, ActiveX, VBScript). 

Moderate-Impact System 

[FIPS 200]

An information system in which at least one security 

objective (i.e., confidentiality, integrity, or availability) is 

assigned a FIPS 199 potential impact value of moderate 

and no security objective is assigned a FIPS 199 potential 

impact value of high. 

APPENDIX B PAGE B-8 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

National Security Emergency 

Preparedness Telecommunications 

Services 

[47 C.F.R., Part 64, App A] 

Telecommunications services that are used to maintain a 

state of readiness or to respond to and manage any event 

or crisis (local, national, or international) that causes or 

could cause injury or harm to the population, damage to 

or loss of property, or degrade or threaten the national 

security or emergency preparedness posture of the United 

States. 

National Security 

Information

Information that has been determined pursuant to 

Executive Order 12958 as amended by Executive Order 

13292, or any predecessor order, or by the Atomic 

Energy Act of 1954, as amended, to require protection 

against unauthorized disclosure and is marked to indicate 

its classified status. 

National Security System 

[44 U.S.C., Sec. 3542] 

Any information system (including any 

telecommunications system) used or operated by an 

agency or by a contractor of an agency, or other 

organization on behalf of an agency— (i) the function, 

operation, or use of which involves intelligence activities; 

involves cryptologic activities related to national security; 

involves command and control of military forces; 

involves equipment that is an integral part of a weapon or 

weapons system; or is critical to the direct fulfillment of 

military or intelligence missions (excluding a system that 

is to be used for routine administrative and business 

applications, for example, payroll, finance, logistics, and 

personnel management applications); or (ii) is protected 

at all times by procedures established for information that 

have been specifically authorized under criteria 

established by an Executive Order or an Act of Congress 

to be kept classified in the interest of national defense or 

foreign policy. 

Non-repudiation 

[CNSS Inst. 4009] 

Assurance that the sender of information is provided with 

proof of delivery and the recipient is provided with proof 

of the sender’s identity, so neither can later deny having 

processed the information. 

Operational Controls 

[FIPS 200]

The security controls (i.e., safeguards or 

countermeasures) for an information system that are 

primarily implemented and executed by people (as 

opposed to systems). 

Organization 

[FIPS 200] 

A federal agency or, as appropriate, any of its operational 

elements. 

Penetration Testing A test methodology in which assessors, using all 

available documentation (e.g., system design, source 

code, manuals) and working under specific constraints, 

attempt to circumvent the security features of an 

information system. 

APPENDIX B PAGE B-9 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Plan of Action and 

Milestones 

[OMB Memorandum 02-01]

A document that identifies tasks needing to be 

accomplished. It details resources required to accomplish 

the elements of the plan, any milestones in meeting the 

tasks, and scheduled completion dates for the milestones. 

Potential Impact 

[FIPS 199] 

The loss of confidentiality, integrity, or availability could 

be expected to have: (i) a limited adverse effect (FIPS 

199 low); (ii) a serious adverse effect (FIPS 199 

moderate); or (iii) a severe or catastrophic adverse effect 

(FIPS 199 high) on organizational operations, 

organizational assets, or individuals. 

Privacy Impact Assessment 

[OMB Memorandum 03-22]

An analysis of how information is handled: (i) to ensure 

handling conforms to applicable legal, regulatory, and 

policy requirements regarding privacy; (ii) to determine 

the risks and effects of collecting, maintaining, and 

disseminating information in identifiable form in an 

electronic information system; and (iii) to examine and 

evaluate protections and alternative processes for 

handling information to mitigate potential privacy risks. 

Privileged Function A function executed on an information system involving 

the control, monitoring, or administration of the system. 

Privileged User 

[CNSS Inst. 4009]

Individual who has access to system control, monitoring, 

or administration functions (e.g., system administrator, 

information system security officer, maintainer, system 

programmer). 

Protective Distribution System Wire line or fiber optic system that includes adequate 

safeguards and/or countermeasures (e.g., acoustic, 

electric, electromagnetic, and physical) to permit its use 

for the transmission of unencrypted information. 

Records The recordings (automated and/or manual) of evidence of 

activities performed or results achieved (e.g., forms, 

reports, test results), which serve as a basis for verifying 

that the organization and the information system are 

performing as intended. Also used to refer to units of 

related data fields (i.e., groups of data fields that can be 

accessed by a program and that contain the complete set 

of information on particular items). 

Remote Access Access to an organizational information system by a user 

(or an information system) communicating through an 

external, non-organization-controlled network (e.g., the 

Internet). 

Remote Maintenance Maintenance activities conducted by individuals 

communicating through an external, non-organizationcontrolled network (e.g., the Internet). 

APPENDIX B PAGE B-10 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Risk 

[FIPS 200, Adapted] 

The level of impact on organizational operations 

(including mission, functions, image, or reputation), 

organizational assets, individuals, other organizations, or 

the Nation resulting from the operation of an information 

system given the potential impact of a threat and the 

likelihood of that threat occurring. 

Risk Assessment 

[NIST SP 800-30, Adapted] 

The process of identifying risks to agency operations 

(including mission, functions, image, or reputation), 

agency assets, or individuals arising through the 

operation of the information system. Part of risk 

management, synonymous with risk analysis, 

incorporates threat and vulnerability analyses, and 

considers mitigations provided by planned or in-place 

security controls. 

Risk Management 

[FIPS 200] 

The process of managing risks to organizational 

operations (including mission, functions, image, or 

reputation), organizational assets, or individuals resulting 

from the operation of an information system, and 

includes: (i) the conduct of a risk assessment; (ii) the 

implementation of a risk mitigation strategy; and (iii) 

employment of techniques and procedures for the 

continuous monitoring of the security state of the 

information system. 

Safeguards 

[CNSS Inst. 4009, Adapted] 

Protective measures prescribed to meet the security 

requirements (i.e., confidentiality, integrity, and 

availability) specified for an information system. 

Safeguards may include security features, management 

constraints, personnel security, and security of physical 

structures, areas, and devices. Synonymous with security 

controls and countermeasures. 

Security Control Assessment The testing and/or evaluation of the management, 

operational, and technical security controls in an 

information system to determine the extent to which the 

controls are implemented correctly, operating as 

intended, and producing the desired outcome with respect 

to meeting the security requirements for the system.

Security Category 

[FIPS 199] 

The characterization of information or an information 

system based on an assessment of the potential impact 

that a loss of confidentiality, integrity, or availability of 

such information or information system would have on 

organizational operations, organizational assets, or 

individuals. 

Security Controls 

[FIPS 199] 

The management, operational, and technical controls 

(i.e., safeguards or countermeasures) prescribed for an 

information system to protect the confidentiality, 

integrity, and availability of the system and its 

information. 

APPENDIX B PAGE B-11 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Security Control Baseline 

[FIPS 200]

The set of minimum security controls defined for a lowimpact, moderate-impact, or high-impact information 

system. 

Security Control Enhancements Statements of security capability to: (i) build in 

additional, but related, functionality to a basic control; 

and/or (ii) increase the strength of a basic control. 

Security Functions The hardware, software, and firmware of the information 

system responsible for supporting and enforcing the 

system security policy and supporting the isolation of 

code and data on which the protection is based. 

Security Impact Analysis 

[NIST SP 800-37]

The analysis conducted by an agency official, often 

during the continuous monitoring phase of the security 

certification and accreditation process, to determine the 

extent to which changes to the information system have 

affected the security posture of the system. 

Security Incident See Incident. 

Security Label Explicit or implicit marking of a data structure or output 

media associated with an information system representing 

the FIPS 199 security category, or distribution limitations 

or handling caveats of the information contained therein. 

Security Objective 

[FIPS 199]

Confidentiality, integrity, or availability. 

Security Perimeter See Accreditation Boundary. 

Security Plan See System Security Plan. 

Security Requirements 

[FIPS 200] 

Requirements levied on an information system that are 

derived from applicable laws, Executive Orders, 

directives, policies, standards, instructions, regulations, 

procedures, or organizational mission/business case needs 

to ensure the confidentiality, integrity, and availability of 

the information being processed, stored, or transmitted. 

Senior Agency 

Information Security 

Officer 

[44 U.S.C., Sec. 3544]

Official responsible for carrying out the Chief 

Information Officer responsibilities under FISMA and 

serving as the Chief Information Officer’s primary liaison 

to the agency’s authorizing officials, information system 

owners, and information system security officers. Also 

known as Chief Information Security Officer. 

Specification An assessment object that includes document-based 

artifacts (e.g., policies, procedures, plans, system security 

requirements, functional specifications, and architectural 

designs) associated with an information system. 

Spyware Software that is secretly or surreptitiously installed into 

an information system to gather information on 

individuals or organizations without their knowledge; a 

type of malicious code. 

APPENDIX B PAGE B-12 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Subsystem A major subdivision or component of an information 

system consisting of information, information 

technology, and personnel that performs one or more 

specific functions. 

Supplementation (Assessment 

Procedures) 

The process of adding assessment procedures or 

assessment details to assessment procedures in order to 

adequately meet the organization’s risk management 

needs. 

Supplementation (Security 

Controls) 

The process of adding security controls or control 

enhancements to the low, moderate, or high security 

control baselines in NIST Special Publication 800-53 in 

order to adequately meet the organization’s risk 

management needs. 

System See Information System. 

System Security Plan 

[NIST SP 800-18, Rev 1] 

Formal document that provides an overview of the 

security requirements for the information system and 

describes the security controls in place or planned for 

meeting those requirements. 

System-specific Security Control 

[NIST SP 800-37]

Security control for an information system that has not 

been designated as a common security control. 

Tailoring (Assessment Procedures) The process by which assessment procedures defined in 

Special Publication 800-53A are adjusted, or scoped, to 

match the characteristics of the information system under 

assessment, providing organizations with the flexibility 

needed to meet specific organizational requirements and 

to avoid overly-constrained assessment approaches. 

Tailoring (Security Controls) The process by which a security control baseline selected 

in accordance with the FIPS 199 security categorization 

of the information system is modified based on: (i) the 

application of scoping guidance; (ii) the specification of 

compensating security controls, if needed; and (iii) the 

specification of organization-defined parameters in the 

security controls, where allowed. 

Tailored Security Control Baseline Set of security controls resulting from the application of 

the tailoring guidance in NIST Special Publication 800-

53 to the security control baseline. 

Technical Controls 

[FIPS 200]

The security controls (i.e., safeguards or 

countermeasures) for an information system that are 

primarily implemented and executed by the information 

system through mechanisms contained in the hardware, 

software, or firmware components of the system. 

APPENDIX B PAGE B-13 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX B PAGE B-14 

Test A type of assessment method that is characterized by the 

process of exercising one or more assessment objects 

under specified conditions to compare actual with 

expected behavior, the results of which are used to 

support the determination of security control 

effectiveness over time. 

Threat 

[CNSS Inst. 4009, Adapted]

Any circumstance or event with the potential to adversely 

impact agency operations (including mission, functions, 

image, or reputation), agency assets, or individuals 

through an information system via unauthorized access, 

destruction, disclosure, modification of information, 

and/or denial of service. 

Threat Source 

[FIPS 200]

The intent and method targeted at the intentional 

exploitation of a vulnerability or a situation and method 

that may accidentally trigger a vulnerability. 

Synonymous with threat agent. 

Threat Assessment 

[CNSS Inst. 4009] 

Formal description and evaluation of threat to an 

information system. 

Trusted Path A mechanism by which a user (through an input device) 

can communicate directly with the security functions of 

the information system with the necessary confidence to 

support the system security policy. This mechanism can 

be activated only by the user or the security functions of 

the information system and cannot be imitated by 

untrusted software. 

User 

[CNSS Inst. 4009]

Individual or (system) process authorized to access an 

information system. 

Vulnerability 

[CNSS Inst. 4009, Adapted] 

Weakness in an information system, system security 

procedures, internal controls, or implementation that 

could be exploited or triggered by a threat source. 

Vulnerability Assessment 

[CNSS Inst. 4009] 

Formal description and evaluation of the vulnerabilities 

in an information system. 

White Box Testing See Detailed Testing. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX C

ACRONYMS

COMMON ABBREVIATIONS 

CFR Code of Federal Regulations 

CIO Chief Information Officer 

CNSS Committee for National Security Systems 

COTS Commercial Off-The-Shelf 

DCID Director of Central Intelligence Directive 

DNS Domain Name System 

FIPS Federal Information Processing Standards 

FISMA Federal Information Security Management Act 

IEEE Institute of Electrical and Electronics Engineers 

ISAP Information Security Automation Program 

IPsec Internet Protocol Security 

NIST National Institute of Standards and Technology 

NSA National Security Agency 

NSTISSI National Security Telecommunications and Information System Security 

Instruction 

OMB Office of Management and Budget 

PIV Personal Identity Verification 

PKI Public Key Infrastructure 

POAM Plan of Action and Milestones 

SCAP Security Content Automation Protocol 

SP Special Publication 

TCP/IP Transmission Control Protocol/Internet Protocol 

TSP Telecommunications Service Priority 

U.S.C. United States Code 

VPN Virtual Private Network 

VoIP Voice over Internet Protocol 

APPENDIX C PAGE C-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX D

ASSESSMENT METHOD DESCRIPTIONS

ASSESSMENT METHOD DEFINITIONS, APPLICABLE OBJECTS, AND ATTRIBUTES 

his appendix provides complete definitions of the three assessment methods that can be 

used by assessors during security control assessments: (i) examine; (ii) interview; and (iii) 

test. The definitions include a set of attributes and attribute values for each of the 

assessment methods. The attribute values for the assessment methods (which describe the rigor 

and level of detail associated with the assessment) are hierarchical in nature. For the depth 

attribute, the focused attribute value includes and builds upon the assessment rigor and level of 

detail defined for the generalized attribute value; the detailed attribute value includes and builds 

upon the assessment rigor and level of detail defined for the focused attribute value. For the 

coverage attribute, the specific attribute value includes and builds upon the number and type of 

assessment objects defined for the representative attribute value; the comprehensive attribute 

value includes and builds upon the number and type of assessment objects defined for the specific 

attribute value. The use of bolded text in the assessment method descriptions indicates the 

content that was added to the attribute value descriptions and appears for the first time. 

T

APPENDIX D PAGE D-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT METHOD: Examine

ASSESSMENT OBJECTS: Specifications (e.g., policies, plans, procedures, system requirements, designs) 

Mechanisms (e.g., functionality implemented in hardware, software, firmware)

Activities (e.g., system operations, administration, management; exercises) 

DEFINITION: The process of checking, inspecting, reviewing, observing, studying, or analyzing one or more 

assessment objects to facilitate understanding, achieve clarification, or obtain evidence, the results of which 

are used to support the determination of security control existence, functionality, correctness, completeness, 

and potential for improvement over time. 

SUPPLEMENTAL GUIDANCE: Typical assessor actions may include, for example: reviewing information 

security policies, plans, and procedures; analyzing system design documentation and interface 

specifications; observing system backup operations, reviewing the results of contingency plan exercises; 

observing incident response activities; studying technical manuals and user/administrator guides; checking, 

studying, or observing the operation of an information technology mechanism in the information system 

hardware/software; or checking, studying, or observing physical security measures related to the operation 

of an information system. 

ATTRIBUTES: Depth, Coverage

• The depth attribute addresses the rigor of and level of detail in the examination process. There are 

three possible values for the depth attribute: (i) generalized; (ii) focused; and (iii) detailed. 

- Generalized examination: Examination that consists of high-level reviews, checks, observations, or 

inspections of the assessment object. This type of examination is conducted using a limited body of evidence 

or documentation (e.g., functional-level descriptions for mechanisms; high-level process descriptions for 

activities; and actual documents for specifications). Generalized examinations provide a level of 

understanding of the security control necessary for determining whether the control is implemented and free 

of obvious errors. 

- Focused examination: Examination that consists of high-level reviews, checks, observations, or inspections 

and more in depth analyses of the assessment object. This type of examination is conducted using a 

substantial body of evidence or documentation (e.g., functional-level descriptions and where appropriate 

and available, high-level design information for mechanisms; high-level process descriptions and 

implementation procedures for activities; and the actual documents and related documents for 

specifications). Focused examinations provide a level of understanding of the security control necessary for 

determining whether the control is implemented and free of obvious errors and whether there are increased 

grounds for confidence that the control is implemented correctly and operating as intended. 

- Detailed examination: Examination that consists of high-level reviews, checks, observations, or inspections 

and more in depth, detailed, and thorough analyses of the assessment object. This type of examination is 

conducted using an extensive body of evidence or documentation (e.g., functional-level descriptions and 

where appropriate and available, high-level design information, low-level design information, and 

implementation information for mechanisms; high-level process descriptions and detailed implementation 

procedures for activities; and the actual documents and related documents for specifications43). Detailed 

examinations provide a level of understanding of the security control necessary for determining whether the 

control is implemented and free of obvious errors and whether there are further increased grounds for 

confidence that the control is implemented correctly and operating as intended on an ongoing and consistent 

basis, and that there is support for continuous improvement in the effectiveness of the control. 

• The coverage attribute addresses the scope or breadth of the examination process and includes the 

types of assessment objects to be examined, the number of objects to be examined (by type), and 

specific objects to be examined.44 There are three possible values for the coverage attribute: (i) 

representative, (ii) specific, and (iii) comprehensive. 

 

43 While additional documentation is likely for mechanisms when moving from generalized to focused to detailed 

examinations, the documentation used with regard to specifications and activities may be the same for focused and 

detailed examinations, with the rigor of the examinations of these documents being increased at the detailed level. 

44 The organization, considering a variety of factors (e.g., available resources, importance of the assessment, the 

organization’s overall assessment goals and objectives), confers with assessors and provides direction on the type, 

number, and specific objects to be examined for the particular attribute value described. 

APPENDIX D PAGE D-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

- Representative examination: Examination that uses a representative sample of assessment objects (by type 

and number within type) to provide a level of coverage necessary for determining whether the security 

control is implemented and free of obvious errors. 

- Specific examination: Examination that uses a representative sample of assessment objects (by type and 

number within type) and other specific assessment objects deemed particularly important to achieving 

the assessment objective to provide a level of coverage necessary for determining whether the security 

control is implemented and free of obvious errors and whether there are increased grounds for confidence 

that the control is implemented correctly and operating as intended. 

- Comprehensive examination: Examination that uses a sufficiently large sample of assessment objects (by 

type and number within type) and other specific assessment objects deemed particularly important to 

achieving the assessment objective to provide a level of coverage necessary for determining whether the 

security control is implemented and free of obvious errors and whether there are further increased grounds 

for confidence that the control is implemented correctly and operating as intended on an ongoing and 

consistent basis, and that there is support for continuous improvement in the effectiveness of the 

control. 

APPENDIX D PAGE D-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT METHOD: Interview

ASSESSMENT OBJECTS: Individuals or groups of individuals.

DEFINITION: The process of conducting discussions with individuals or groups within an organization to 

facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are 

used to support the determination of security control existence, functionality, correctness, completeness, 

and potential for improvement over time. 

SUPPLEMENTAL GUIDANCE: Typical assessor actions may include, for example, interviewing agency 

heads, chief information officers, senior agency information security officers, authorizing officials, 

information owners, information system and mission owners, information system security officers, 

information system security managers, personnel officers, human resource managers, facilities managers, 

training officers, information system operators, network and system administrators, site managers, physical 

security officers, and users. 

ATTRIBUTES: Depth, Coverage 

• The depth attribute addresses the rigor of and level of detail in the interview process. There are three 

possible values for the depth attribute: (i) generalized; (ii) focused; and (iii) detailed. 

- Generalized interview: Interview that consists of broad-based, high-level discussions with individuals or 

groups of individuals. This type of interview is conducted using a set of generalized, high-level questions. 

Generalized interviews provide a level of understanding of the security control necessary for determining 

whether the control is implemented and free of obvious errors. 

- Focused interview: Interview that consists of broad-based, high-level discussions and more in depth 

discussions in specific areas with individuals or groups of individuals. This type of interview is conducted 

using a set of generalized, high-level questions and more in depth questions in specific areas where 

responses indicate a need for more in depth investigation. Focused interviews provide a level of 

understanding of the security control necessary for determining whether the control is implemented and free 

of obvious errors and whether there are increased grounds for confidence that the control is 

implemented correctly and operating as intended. 

- Detailed interview: Interview that consists of broad-based, high-level discussions and more in depth, probing

discussions in specific areas (including other assessment results) with individuals or groups of individuals. 

This type of interview is conducted using a set of generalized, high-level questions and more in depth, 

probing questions in specific areas where responses indicate a need for more in depth investigation or where 

called for by assessment procedures. Detailed interviews provide a level of understanding of the security 

control necessary for determining whether the control is implemented and free of obvious errors and whether 

there are further increased grounds for confidence that the control is implemented correctly and operating as 

intended on an ongoing and consistent basis, and that there is support for continuous improvement in 

the effectiveness of the control. 

• The coverage attribute addresses the scope or breadth of the interview process and includes the types 

of individuals to be interviewed (by organizational role and associated responsibility), the number of 

individuals to be interviewed (by type), and specific individuals to be interviewed.45 There are three 

possible values for the coverage attribute: (i) representative, (ii) specific, and (iii) comprehensive. 

- Representative interview: Interview that uses a representative sample of individuals in key organizational 

roles to provide a level of coverage necessary for determining whether the security control is implemented 

and free of obvious errors. 

- Specific interview: Interview that uses a representative sample of individuals in key organizational roles and 

other specific individuals deemed particularly important to achieving the assessment objective to 

provide a level of coverage necessary for determining whether the security control is implemented and free of 

obvious errors and whether there are increased grounds for confidence that the control is implemented 

correctly and operating as intended. 

 

45 The organization, considering a variety of factors (e.g., available resources, importance of the assessment, the 

organization’s overall assessment goals and objectives), confers with assessors and provides direction on the type, 

number, and specific individuals to be interviewed for the particular attribute value described. 

APPENDIX D PAGE D-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

- Comprehensive interview: Interview that uses a sufficiently large sample of individuals in key organizational 

roles and other specific individuals deemed particularly important to achieving the assessment objective to 

provide a level of coverage necessary for determining whether the security control is implemented and free of 

obvious errors and whether there are further increased grounds for confidence that the control is 

implemented correctly and operating as intended on an ongoing and consistent basis, and that there is 

support for continuous improvement in the effectiveness of the control. 

APPENDIX D PAGE D-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT METHOD: Test

ASSESSMENT OBJECTS: Mechanisms (e.g., hardware, software, firmware)

Activities (e.g., system operations, administration, management; exercises) 

DEFINITION: The process of exercising one or more assessment objects under specified conditions to 

compare actual with expected behavior, the results of which are used to support the determination of 

security control existence, functionality, correctness, completeness, and potential for improvement over 

time.46

SUPPLEMENTAL GUIDANCE: Typical assessor actions may include, for example: testing access control, 

identification and authentication, and audit mechanisms; testing security configuration settings; testing 

physical access control devices; conducting penetration testing of key information system components;

testing information system backup operations; testing incident response capability; and exercising 

contingency planning capability. 

ATTRIBUTES: Depth, Coverage

• The depth attribute addresses the types of testing to be conducted. There are three possible values for 

the depth attribute: (i) generalized testing; (ii) focused testing; and (iii) detailed testing. 

- Generalized testing: Test methodology (also known as black box testing) that assumes no knowledge of the 

internal structure and implementation detail of the assessment object. This type of testing is conducted using 

a functional specification for mechanisms and a high-level process description for activities. Generalized 

testing provides a level of understanding of the security control necessary for determining whether the control 

is implemented and free of obvious errors. 

- Focused testing: Test methodology (also known as gray box testing) that assumes some knowledge of the 

internal structure and implementation detail of the assessment object. This type of testing is conducted using 

a functional specification and limited system architectural information (e.g., high-level design) for 

mechanisms and a high-level process description and high-level description of integration into the 

operational environment for activities. Focused testing provides a level of understanding of the security 

control necessary for determining whether the control is implemented and free of obvious errors and 

whether there are increased grounds for confidence that the control is implemented correctly and 

operating as intended. 

- Detailed testing: Test methodology (also known as white box testing) that assumes explicit and substantial

knowledge of the internal structure and implementation detail of the assessment object. This type of testing 

is conducted using a functional specification, extensive system architectural information (e.g., high-level 

design, low-level design) and implementation representation (e.g., source code, schematics) for 

mechanisms and a high-level process description and detailed description of integration into the operational 

environment for activities. Detailed testing provides a level of understanding of the security control 

necessary for determining whether the control is implemented and free of obvious errors and whether there 

are further increased grounds for confidence that the control is implemented correctly and operating as 

intended on an ongoing and consistent basis, and that there is support for continuous improvement in 

the effectiveness of the control. 

• The coverage attribute addresses the scope or breadth of the testing process and includes the types of 

assessment objects to be tested, the number of objects to be tested (by type), and specific objects to be 

tested.47 There are three possible values for the coverage attribute: (i) representative; (ii) specific; and 

(iii) comprehensive. 

 

46 Testing is typically used to determine if mechanisms or activities meet a set of predefined specifications. Testing can 

also be performed to determine characteristics of a security control that are not commonly associated with predefined 

specifications, with an example of such testing being penetration testing. Guidelines for conducting penetration testing 

are provided in Appendix G. 

47 The organization, considering a variety of factors (e.g., available resources, importance of the assessment, the 

organization’s overall assessment goals and objectives), confers with assessors and provides direction on the type, 

number, and specific objects to be tested for the particular attribute value described. For mechanism-related testing, the 

coverage attribute also addresses the extent of the testing conducted (e.g., for software, the number of test cases and 

modules tested; for hardware, the range of inputs, number of components tested, and range of environmental factors 

over which the testing is conducted). 

APPENDIX D PAGE D-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX D PAGE D-7 

- Representative testing: Testing that uses a representative sample of assessment objects (by type and number 

within type) to provide a level of coverage necessary for determining whether the security control is 

implemented and free of obvious errors. 

- Specific testing: Testing that uses a representative sample of assessment objects (by type and number within 

type) and other specific assessment objects deemed particularly important to achieving the assessment 

objective to provide a level of coverage necessary for determining whether the security control is 

implemented and free of obvious errors and whether there are increased grounds for confidence that the 

control is implemented correctly and operating as intended. 

- Comprehensive testing: Testing that uses a sufficiently large sample of assessment objects (by type and 

number within type) and other specific assessment objects deemed particularly important to achieving the 

assessment objective to provide a level of coverage necessary for determining whether the security control is 

implemented and free of obvious errors and whether there are further increased grounds for confidence that 

the control is implemented correctly and operating as intended on an ongoing and consistent basis, and 

that there is support for continuous improvement in the effectiveness of the control. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX E

ASSESSMENT EXPECTATIONS 

EXPECTATIONS OF SECURITY CONTROL ASSESSMENTS BY IMPACT LEVEL 

he following section establishes the expectations for security control assessments based on 

the assurance requirements defined in NIST Special Publication 800-53. The assessment 

expectations provide assessors with important reference points for the level of assurance 

(i.e., grounds for confidence) needed for the determination of security control effectiveness. The 

use of bolded text in the assurance requirements and assessment objectives in this section 

indicates additions to the requirements and objectives that appear for the first time at a particular 

information system impact level. 

T 

LOW-IMPACT INFORMATION SYSTEMS

Assurance Requirement: The security control is in effect and meets explicitly identified functional 

requirements in the control statement. 

Supplemental Guidance: For security controls in low-impact information systems, the focus is on the controls 

being in place with the expectation that no obvious errors exist and that, as flaws are discovered, they are 

addressed in a timely manner.

Assessment Expectations: Generalized interviews, examinations, and tests are conducted using a 

representative set of assessment objects to demonstrate that the security control is implemented and free of 

obvious errors. 

Assessment Objectives: 

For specifications: 

- Determine if the specification exists. 

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious internal errors. 

For mechanisms: 

- Determine if the mechanism is implemented and operational. 

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious implementation errors. 

For activities: 

- Determine if the activity is being performed. 

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious execution errors. 

APPENDIX E PAGE E-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

MODERATE-IMPACT INFORMATION SYSTEMS

Assurance Requirement: The security control is in effect and meets explicitly identified functional 

requirements in the control statement. The control developer/implementer provides a description of the 

functional properties of the control with sufficient detail to permit analysis and testing of the control. 

The control developer/implementer includes as an integral part of the control, assigned 

responsibilities and specific actions supporting increased confidence that when the control is 

implemented, it will meet its required function or purpose. These actions include, for example, 

requiring the development of records with structure and content suitable to facilitate making this 

determination. 

Supplemental Guidance: For security controls in moderate-impact information systems, the focus is on 

actions supporting increased confidence in the correct implementation and operation of the control. While 

flaws are still likely to be uncovered (and addressed expeditiously), the control developer/implementer 

incorporates, as part of the control, specific capabilities and produces specific documentation supporting 

increased confidence that the control meets its required function or purpose. This documentation is also 

needed by assessors to analyze and test the functional properties of the control as part of the overall 

assessment of the control. 

Assessment Expectations: Focused interviews, examinations, and tests are conducted using a specific set of 

assessment objects to demonstrate that the security control is implemented and free of obvious errors, and 

that there are increased grounds for confidence that the security control is implemented correctly 

and operating as intended. 

Assessment Objectives: 

For specifications:

- Determine if the specification exists. 

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious internal errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the specification is complete, internally 

consistent, correct, and meets its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the application or use of 

the specification. 

For mechanisms: 

- Determine if the mechanism is implemented and operational. 

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious implementation errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the mechanism is implemented correctly, 

operating as intended, and meets its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the implementation or 

operation of the mechanism. 

For activities: 

- Determine if the activity is being performed. 

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious execution errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the activity is being performed correctly 

and meets its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the conduct or 

execution of the activity. 

APPENDIX E PAGE E-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

HIGH-IMPACT INFORMATION SYSTEMS

Assurance Requirement: The security control is in effect and meets explicitly identified functional 

requirements in the control statement. The control developer/implementer provides a description of the 

functional properties and design/implementation of the control with sufficient detail to permit analysis 

and testing of the control (including functional interfaces among control components). The control 

developer/implementer includes as an integral part of the control, assigned responsibilities and specific 

actions supporting increased confidence that when the control is implemented, it will continuously and 

consistently (i.e., across the information system) meet its required function or purpose and support 

improvement in the effectiveness of the control. These actions include, for example, requiring the 

development of records with structure and content suitable to facilitate making this determination. 

Supplemental Guidance: For security controls in high-impact information systems, the focus is expanded to 

require, within the control, the capabilities that are needed to support ongoing consistent operation of the 

control and continuous improvement in the control’s effectiveness. The developer/implementer is expected 

to expend significant effort on the design, development, implementation, and component/integration testing 

of the controls and to produce associated design and implementation documentation to support these 

activities. This documentation is also needed by assessors to analyze and test the internal components of 

the control as part of the overall assessment of the control. 

Assessment Expectations: Detailed interviews, examinations, and tests are conducted using a 

comprehensive set of assessment objects to demonstrate that the security control is implemented and free 

of obvious errors and that there are further increased grounds for confidence that the security control is 

implemented correctly and operating as intended on an ongoing and consistent basis, and that there is 

support for continuous improvement in the effectiveness of the control. 

Assessment Objectives: 

For specifications:

- Determine if the specification exists. 

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious internal errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the specification is complete, internally consistent, 

correct, and meets its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the application or use of the 

specification. 

- Determine if the organization applies the specification consistently across the information system. 

- Determine if the organization supports improvement in the effectiveness of the specification by taking 

specific actions to correct identified deficiencies. 

For mechanisms: 

- Determine if the mechanism is implemented and operational. 

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious implementation errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating 

as intended, and meets its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation 

of the mechanism. 

- Determine if the organization implements the mechanism consistently across the information system. 

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking 

specific actions to correct identified deficiencies. 

APPENDIX E PAGE E-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

For activities: 

- Determine if the activity is being performed. 

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the 

security control and no obvious execution errors. 

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate 

documentation to support increased grounds for confidence that the activity is being performed correctly and meets 

its required function or purpose. 

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the 

activity. 

- Determine if the organization performs the activity consistently across the information system. 

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific 

actions to correct identified deficiencies. 

ADDITIONAL REQUIREMENTS TO SUPPLEMENT MODERATE- AND HIGH-IMPACT INFORMATION SYSTEMS

Assurance Requirement: The security control is in effect and meets explicitly identified functional 

requirements in the control statement. The control developer/implementer provides a description of the 

functional properties and design/implementation of the control with sufficient detail to permit analysis and 

testing of the control. The control developer/implementer includes as an integral part of the control, actions 

supporting increased confidence that when the control is implemented, it will continuously and consistently 

(i.e., across the information system) meet its required function or purpose and support improvement in the 

effectiveness of the control. These actions include requiring the development of records with structure and 

content suitable to facilitate making this determination. The control is developed in a manner that 

supports a high degree of confidence that the control is complete, consistent, and correct.

Supplemental Guidance: The additional high assurance requirements are intended to supplement the 

minimum assurance requirements for the moderate and high baselines, when appropriate, in order to protect 

against threats from highly skilled, highly motivated, and well-financed threat agents. This level of 

protection is necessary for those information systems where the organization is not willing to accept the 

risks associated with the type of threat agents cited above.

Table E-1 provides a summary of the assessment expectations for low-impact, moderate-impact, 

and high-impact information systems. 

TABLE E-1: ASSESSMENT EXPECTATIONS BY INFORMATION SYSTEM IMPACT LEVEL 

INFORMATION SYSTEM IMPACT LEVEL

ASSESSMENT EXPECTATIONS LOW MODERATE HIGH

Security controls are in place with no obvious errors. √ √ √

Increased grounds for confidence that the security controls are 

implemented correctly and operating as intended. --- √ √

Further increased grounds for confidence that the security controls are 

implemented correctly and operating as intended on an ongoing and 

consistent basis, and that there is support for continuous improvement 

in the effectiveness of the control. 

--- --- √

Grounds for a high degree of confidence that the security controls are 

complete, consistent, and correct. 

Beyond minimum recommendations of NIST Special Publication 800-53A

--- For environments with specific 

and credible threat information 

indicating sophisticated, wellresourced threat agents and 

possible attacks against highvalue targets.

APPENDIX E PAGE E-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX E PAGE E-5 

Table E-2 provides a summary of the assessment method attributes and attribute values described 

in Appendix D by information system impact level. The associated value assigned to a particular 

attribute provides a direct link to the assurance requirements in NIST Special Publication 800-53. 

TABLE E-2: ASSESSMENT METHOD ATTRIBUTES AND ATTRIBUTE VALUES BY IMPACT LEVEL 

ASSESSMENT METHODS

Examine, Interview, Test

INFORMATION SYSTEM IMPACT LEVEL

ATTRIBUTE LOW MODERATE HIGH

Depth Generalized Focused Detailed

Coverage48 Representative Specific Comprehensive

 

48 The types and number of assessment objects included in the assessment should be a function of the FIPS 199 impact 

level of the information system. Organizations should consider increasing the types and number of objects assessed as 

the impact level of the information system increases. The increased depth and coverage of the assessment contributes 

to greater assurance in the overall effectiveness of the security controls under assessment. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F

ASSESSMENT PROCEDURE CATALOG 

OBJECTIVES, METHODS, AND OBJECTS FOR ASSESSING SECURITY CONTROLS 

his appendix provides a catalog of procedures to assess the security controls and control 

enhancements in NIST Special Publication 800-53.49 The assessment procedures listed in 

Section I, are aligned with the security control catalog in Special Publication 800-53. 

Assessors should select the appropriate assessment procedures from the catalog in this appendix 

for the security controls and control enhancements included in the information system security 

plan that are to be assessed in a particular assessment. Since the contents of the security plan 

drive the development of the security assessment plan and the assessment, there will likely be 

assessment procedures in the catalog that assessors will not use because: (i) the associated 

security controls or control enhancements are not contained in the security plan for the 

information system; or (ii) the security controls or control enhancements are not being assessed at 

this particular time (e.g., during an assessment of a subset of the controls related to continuous 

monitoring activities). 

T 

In addition to the assessment procedures provided for security controls and control enhancements, 

the catalog also contains an extended assessment procedure in Section II that is employed by 

assessors to obtain additional assurance-related evidence to support the grounds for confidence 

that the security controls are effective in their application. The extended assessment procedure, 

which follows the assessment procedures in the catalog, can be applied by the organization in a 

variety of ways depending on how the information system security controls are developed and 

implemented, and how the organization manages its security control assessment processes. 

Section 3.3 of this document provides guidance on the application of the extended assessment 

procedure. 

Each assessment procedure consists of one or more assessment objectives, which are used in 

assessing particular aspects of a security control or control enhancement (or in the case of the 

extended assessment procedure, aspects of the security control, control enhancement, family of 

controls, or security controls employed across the organization). Each assessment objective in an 

assessment procedure contains a unique identifier. For example, CP-3.2 indicates that this is the 

second assessment objective for security control CP-3. CP-4(2).1 indicates that this is the first 

assessment objective for the second enhancement for security control CP-4. The extended 

assessment objectives are numbered sequentially (i.e., EAP.1, EAP.2, EAP.3, EAP.4, EAP.5) and 

are employed based upon the impact level of the information system. 

It is recognized that organizations can specify, document, and configure their information systems 

in a variety of ways and that the content and applicability of existing assessment evidence will 

vary. This may result in the need to apply a variety of assessment methods to various assessment 

objects to generate the assessment evidence needed to determine whether the security controls are 

effective in their application. Therefore, a list of potential assessment methods and objects is 

provided with each assessment procedure. Methods and objects are selected from the list of 

potential methods and objects as necessary in order to produce the evidence needed to make the 

determinations listed in the determination statements. As such, assessors should use their 

 

49 For ease of use and quick reference, a description of the security controls and control enhancements from NIST 

Special Publication 800-53 (as amended) is provided in the shaded grey areas at the beginning of the assessment 

procedures. 

APPENDIX F PAGE F-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

judgment in selecting from the potential assessment methods and the general list of assessment 

objects (also known as the object list) associated with each selected method. Assessors should 

select only those methods and objects that most cost-effectively contribute to making the 

determinations associated with the assessment objective. The measure of the quality of the 

assessment results is based on the soundness of the rationale provided, not the specific set of 

methods and objects applied. Specifically, it is anticipated that it will not always be necessary to 

apply every assessment method to every assessment object listed. 

For those security controls and control enhancements contained in the three security control 

baselines in NIST Special Publication 800-53, a suggested application of the potential methods to 

a low-impact, moderate-impact, and high-impact information system assessment is provided by 

the designators (L), (M), or(H) respectively. These designations are intended to assist assessors in the 

selection of the most cost-effective set of methods for the set of security controls and control 

enhancements most often used and with regard to the impact level(s) with which they will most 

commonly be applied. For example, a security control in the low baseline is also in the moderate 

and high baselines, and for such controls, a suggestion is provided as to which methods to apply 

based on whether the control is being used in a low-impact, moderate-impact, or high-impact 

system. For security controls or control enhancements in the moderate or high baselines, but not 

in the low baseline, suggested applicability is only provided with regard to use in moderateimpact or high-impact systems. No indication is provided for low-impact systems because that is 

not likely to be a common usage for such controls and enhancements. 

Additionally, in using the (L), (M), and (H) designations, assessors should keep in mind that 

organizations may have added security controls or control enhancements to the original security 

control baselines in NIST Special Publication 800-53 as a result of applying the security control 

selection and supplementation steps during the execution of the Risk Management Framework. 

Therefore, for all added security controls and control enhancements, assessors should determine 

the appropriate applicability of the potential assessment methods with regard to the information 

system impact level. Moreover, in such situations, the lack of an (L), (M), or(H) designation for the 

information system impact level in the assessment procedure catalog does not mean the 

assessment method is not applied at that level (or that the security control or control enhancement 

is not used in a system at that level). Rather, since the security control or control enhancement 

was not in the associated baseline in Special Publication 800-53, a suggestion for applicability of 

the potential methods to that impact level was simply not determined. 

It should also be noted that the same assessment object may appear in multiple object lists in a 

variety of assessment procedures. The same object may be used in multiple contexts to obtain 

needed information or evidence for a particular aspect of an assessment. Assessors should use the 

general reference as appropriate to obtain the necessary information to make the specified 

determinations required by the assessment objective. For example, a reference to access control 

policy appears in the assessment procedures for AC-2 and AC-7. For assessment procedure AC2, assessors are using the access control policy to find information about that portion of the policy 

that addresses account management for the information system. For assessment procedure AC-7, 

assessors are using the access control policy to find information about that portion of the policy 

that addresses unsuccessful login attempts for the information system. 

APPENDIX F PAGE F-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F PAGE F-3 

Implementation Tips 

TIP #1: Select only those assessment procedures from Appendix F that correspond to a security control 

or control enhancement in an approved system security plan. The selection and supplementation steps 

that occur during the execution of the Risk Management Framework may eliminate or modify certain 

security controls or controls enhancements and affect the final set of controls and control enhancements 

in the final security plan. 

TIP #2: The assessment procedures selected from Appendix F for assessing the security controls in the 

information system are simply exemplary procedures. These procedures should be reviewed and 

appropriately tailored/supplemented as necessary, in accordance with the guidance in Section 3.3 to 

adapt the procedures to specific organizational requirements and operating environments. 

TIP #3: The assessor applies to each method, the appropriate attribute values for depth and coverage 

that are commensurate with the impact level of the information system that is being assessed (see Table 

E-2 in Appendix E). The values applied to the depth and coverage attributes indicate how much effort is 

going to be applied to the assessment (i.e., the rigor, level of intensity, and scope of the activities 

associated with the assessment). 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Section I: Assessment Procedures

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-1 ACCESS CONTROL POLICY AND PROCEDURES 

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, access control policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the access control policy and associated access controls. 

Supplemental Guidance: The access control policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The access control policy can be included as part of the general information 

security policy for the organization. Access control procedures can be developed for the 

security program in general, and for a particular information system, when required. 

NIST Special Publication 800-12 provides guidance on security policies and procedures. 

AC-1.1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the organization develops and documents access control policy and procedures; 

(ii) the organization disseminates access control policy and procedures to appropriate 

elements within the organization; 

(iii) responsible parties within the organization periodically review access control policy 

and procedures; and 

(iv) the organization updates access control policy and procedures when organizational 

review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS: 

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records]. 

(L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with access control responsibilities]. (H)

AC-1.2 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the access control policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the access control policy is consistent with the organization’s mission and functions 

and with applicable laws, directives, policies, regulations, standards, and guidance; 

and 

(iii) the access control procedures address all areas identified in the access control 

policy and address achieving policy-compliant implementations of all associated 

security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS: 

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records]. 

(L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with access control responsibilities]. (H)

APPENDIX F - AC PAGE F-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-2 ACCOUNT MANAGEMENT 

Control: The organization manages information system accounts, including establishing, 

activating, modifying, reviewing, disabling, and removing accounts. The organization 

reviews information system accounts [Assignment: organization-defined frequency, at 

least annually]. 

Supplemental Guidance: Account management includes the identification of account types 

(i.e., individual, group, and system), establishment of conditions for group membership, 

and assignment of associated authorizations. The organization identifies authorized users 

of the information system and specifies access rights/privileges. The organization grants 

access to the information system based on: (i) a valid need-to-know/need-to-share that is 

determined by assigned official duties and satisfying all personnel security criteria; and 

(ii) intended system usage. The organization requires proper identification for requests to 

establish information system accounts and approves all such requests. The organization 

specifically authorizes and monitors the use of guest/anonymous accounts and removes, 

disables, or otherwise secures unnecessary accounts. Account managers are notified 

when information system users are terminated or transferred and associated accounts are 

removed, disabled, or otherwise secured. Account managers are also notified when users’ 

information system usage or need-to-know/need-to-share changes. 

AC-2.1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the organization manages information system accounts, including establishing, 

activating, modifying, reviewing, disabling, and removing accounts; 

(ii) the organization defines the frequency of information system account reviews; 

(iii) the organization reviews information system accounts at the organization-defined 

frequency, at least annually; and 

(iv) the organization initiates required actions on information system accounts based on 

the review. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing account management; 

information system security plan; list of active system accounts along with the name of the 

individual associated with each account; lists of recently transferred, separated, or 

terminated employees; list of recently disabled information system accounts along with the 

name of the individual associated with each account; system-generated records with user 

IDs and last login date; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with account management responsibilities]. (M) (H)

APPENDIX F - AC PAGE F-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-2(1) ACCOUNT MANAGEMENT 

Control Enhancement: 

The organization employs automated mechanisms to support the management of information 

system accounts. 

AC-2(1).1 ASSESSMENT OBJECTIVE: 

Determine if the organization employs automated mechanisms to support information 

system account management functions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Procedures addressing account management; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing account management functions]. (H)

AC-2(2) ACCOUNT MANAGEMENT 

Control Enhancement: 

The information system automatically terminates temporary and emergency accounts after 

[Assignment: organization-defined time period for each type of account]. 

AC-2(2).1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the organization defines a time period after which the information system terminates 

temporary and emergency accounts; and 

(ii) the information system automatically terminates temporary and emergency accounts 

after organization-defined time period for each type of account. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system security plan; information system design documentation; 

information system configuration settings and associated documentation; information 

system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing account management functions]. (H)

APPENDIX F - AC PAGE F-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-2(3) ACCOUNT MANAGEMENT 

Control Enhancement: 

The information system automatically disables inactive accounts after [Assignment: 

organization-defined time period]. 

AC-2(3).1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the organization defines a time period after which the information system disables 

inactive accounts; and 

(ii) the information system automatically disables inactive accounts after organizationdefined time period. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Procedures addressing account management; information system security 

plan; information system design documentation; information system configuration settings 

and associated documentation; information system-generated list of last login dates; 

information system-generated list of active accounts; information system audit records; 

other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing account management functions]. (H)

AC-2(4) ACCOUNT MANAGEMENT 

Control Enhancement: 

The organization employs automated mechanisms to audit account creation, modification, 

disabling, and termination actions and to notify, as required, appropriate individuals. 

AC-2(4).1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the organization employs automated mechanisms to audit account creation, 

modification, disabling, and termination actions; and 

(ii) the organization employs automated mechanisms to notify, as required, appropriate 

individuals. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Procedures addressing account management; information system design 

documentation; information system configuration settings and associated documentation; 

information system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing account management functions]. (H)

APPENDIX F - AC PAGE F-7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-3 ACCESS ENFORCEMENT 

Control: The information system enforces assigned authorizations for controlling access to 

the system in accordance with applicable policy. 

Supplemental Guidance: Access control policies (e.g., identity-based policies, role-based 

policies, rule-based policies) and associated access enforcement mechanisms (e.g., access 

control lists, access control matrices, cryptography) are employed by organizations to 

control access between users (or processes acting on behalf of users) and objects (e.g., 

devices, files, records, processes, programs, domains) in the information system. In 

addition to controlling access at the information system level, access enforcement 

mechanisms are employed at the application level, when necessary, to provide increased 

information security for the organization. Consideration is given to the implementation 

of a controlled, audited, and manual override of automated mechanisms in the event of 

emergencies or other serious events. If encryption of stored information is employed as 

an access enforcement mechanism, the cryptography used is FIPS 140-2 (as amended) 

compliant. Related security control: SC-13. 

AC-3.1 ASSESSMENT OBJECTIVE: 

Determine if: 

(i) the information system enforces assigned authorizations for controlling access to 

the system in accordance with applicable policy; and 

(ii) user privileges on the information system are consistent with the documented user 

authorizations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; 

information system configuration settings and associated documentation; list of assigned 

authorizations (user privileges); information system audit records; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access enforcement policy]. (H)

APPENDIX F - AC PAGE F-8 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-3(1) ACCESS ENFORCEMENT 

Control Enhancement: 

The information system restricts access to privileged functions (deployed in hardware, 

software, and firmware) and security-relevant information to explicitly authorized personnel. 

Enhancement Supplemental Guidance: Explicitly authorized personnel include, for 

example, security administrators, system and network administrators, and other 

privileged users. Privileged users are individuals who have access to system control, 

monitoring, or administration functions (e.g., system administrators, information system 

security officers, maintainers, system programmers). 

AC-3(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization explicitly defines privileged functions and security-relevant 

information for the information system; 

(ii) the organization explicitly authorizes personnel access to privileged functions and 

security-relevant information in accordance with organizational policy; and 

(iii) the information system restricts access to privileged functions (deployed in 

hardware, software, and firmware) and security-relevant information to explicitly 

authorized personnel (e.g., security administrators). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement; list of 

privileged functions and security relevant information; information system configuration 

settings and associated documentation; list of assigned authorizations (user privileges); 

information system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access enforcement policy]. (H)

AC-3(ICS-1) ACCESS ENFORCEMENT 

ICS Control Enhancements: 

The ICS requires dual authorization, based on approved organizational procedures, to 

privileged functions that have impacts on facility, public, and environmental safety. 

ICS Enhancement Supplemental Guidance: The organization does not employ dual-approval 

mechanisms when an immediate response is necessary to ensure public and 

environmental safety. 

AC-3(ICS-1).1

 

ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization explicitly defines privileged functions for the ICS that have 

impacts on facility, public, and environmental safety; and 

(ii) the organization develops and approves procedures addressing dual authorization 

requirements for the ICS. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access enforcement and 

dual authorization; list of privileged functions for ICS; ICS configuration settings and 

associated documentation; list of assigned authorizations (user privileges); ICS audit 

records; other relevant documents or records]. (M) (H)

APPENDIX F - AC PAGE F-9 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL

ASSESSMENT PROCEDURE

AC-4 INFORMATION FLOW ENFORCEMENT 

Control: The information system enforces assigned authorizations for controlling the flow 

of information within the system and between interconnected systems in accordance with 

applicable policy. 

Supplemental Guidance: Information flow control regulates where information is allowed 

to travel within an information system and between information systems (as opposed to 

who is allowed to access the information) and without explicit regard to subsequent 

accesses to that information. A few, of many, generalized examples of possible 

restrictions that are better expressed as flow control than access control are: keeping 

export controlled information from being transmitted in the clear to the Internet, blocking 

outside traffic that claims to be from within the organization, and not passing any web 

requests to the Internet that are not from the internal web proxy. Information flow control 

policies and enforcement mechanisms are commonly employed by organizations to 

control the flow of information between designated sources and destinations (e.g., 

networks, individuals, devices) within information systems and between interconnected 

systems. Flow control is based on the characteristics of the information and/or the 

information path. Specific examples of flow control enforcement can be found in 

boundary protection devices (e.g., proxies, gateways, guards, encrypted tunnels, firewalls, 

and routers) that employ rule sets or establish configuration settings that restrict 

information system services or provide a packet filtering capability. Related security 

control: SC-7. 

AC-4.1 ASSESSMENT OBJECTIVE:

Determine if the information system enforces assigned authorizations for controlling the 

flow of information within the system and between interconnected systems in accordance 

with applicable policy. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; 

information system design documentation; information system configuration settings and 

associated documentation; information system baseline configuration; list of information 

flow authorizations; information system audit records; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information flow enforcement policy]. (H)

AC-4.2 ASSESSMENT OBJECTIVE:

Determine if interconnection agreements address the types of permissible and 

impermissible flow of information between information systems and the required level of 

authorization to allow information flow as defined in the information flow enforcement 

policy and procedures. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; 

information system interconnection agreements; information system configuration settings 

and associated documentation; list of information flow control authorizations; information 

system audit records; other relevant documents or records]. (M) (H)

APPENDIX F - AC PAGE F-10 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-4(1) INFORMATION FLOW ENFORCEMENT 

Control Enhancement:

The information system implements information flow control enforcement using explicit labels 

on information, source, and destination objects as a basis for flow control decisions. 

Enhancement Supplemental Guidance: Information flow control enforcement using explicit 

labels is used, for example, to control the release of certain types of information. 

AC-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system implements information flow control enforcement 

using explicit labels on information, source, and destination objects as a basis for flow 

control decisions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; 

information system design documents; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. 

Test: [SELECT FROM: Automated mechanisms implementing information flow enforcement policy]. 

AC-4(2) INFORMATION FLOW ENFORCEMENT 

Control Enhancement:

The information system implements information flow control enforcement using protected 

processing domains (e.g., domain type-enforcement) as a basis for flow control decisions. 

AC-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system implements information flow control enforcement 

using protected processing domains (e.g., domain type-enforcement) as a basis for flow 

control decisions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; 

information system design documents; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. 

Test: [SELECT FROM: Automated mechanisms implementing information flow enforcement policy].

APPENDIX F - AC PAGE F-11 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-4(3) INFORMATION FLOW ENFORCEMENT 

Control Enhancement:

The information system implements information flow control enforcement using dynamic 

security policy mechanisms as a basis for flow control decisions. 

AC-4(3).1 ASSESSMENT OBJECTIVE:

Determine if the information system implements information flow control enforcement 

using dynamic security policy mechanisms as a basis for flow control decisions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information flow enforcement; 

information system design documents; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. 

Test: [SELECT FROM: Automated mechanisms implementing information flow enforcement policy].

APPENDIX F - AC PAGE F-12 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-5 SEPARATION OF DUTIES 

Control: The information system enforces separation of duties through assigned access 

authorizations. 

Supplemental Guidance: The organization establishes appropriate divisions of responsibility 

and separates duties as needed to eliminate conflicts of interest in the responsibilities and 

duties of individuals. There is access control software on the information system that 

prevents users from having all of the necessary authority or information access to perform 

fraudulent activity without collusion. Examples of separation of duties include: (i) 

mission functions and distinct information system support functions are divided among 

different individuals/roles; (ii) different individuals perform information system support 

functions (e.g., system management, systems programming, quality assurance/testing, 

configuration management, and network security); and (iii) security personnel who 

administer access control functions do not administer audit functions. 

AC-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes appropriate divisions of responsibility and separates 

duties as needed to eliminate conflicts of interest in the responsibilities and duties of 

individuals; and 

(ii) the information system enforces separation of duties through assigned access 

authorizations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing separation of duties; 

information system configuration settings and associated documentation; list of separation 

of duties authorizations; information system audit records; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining appropriate 

divisions of responsibility and separation of duties]. (H)

Test: [SELECT FROM: Automated mechanisms implementing separation of duties policy]. (H)

APPENDIX F - AC PAGE F-13 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-6 LEAST PRIVILEGE 

Control: The information system enforces the most restrictive set of rights/privileges or 

accesses needed by users (or processes acting on behalf of users) for the performance of 

specified tasks. 

Supplemental Guidance: The organization employs the concept of least privilege for 

specific duties and information systems (including specific ports, protocols, and services) 

in accordance with risk assessments as necessary to adequately mitigate risk to 

organizational operations, organizational assets, and individuals. 

AC-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization assigns the most restrictive set of rights/privileges or accesses 

needed by users for the performance of specified tasks; and 

(ii) the information system enforces the most restrictive set of rights/privileges or 

accesses needed by users. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing least privilege; list of assigned 

access authorizations (user privileges); information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining least privileges 

necessary to accomplish specified tasks]. (H)

APPENDIX F - AC PAGE F-14 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE 

AC-7 UNSUCCESSFUL LOGIN ATTEMPTS 

Control: The information system enforces a limit of [Assignment: organization-defined 

number] consecutive invalid access attempts by a user during a [Assignment: 

organization-defined time period] time period. The information system automatically 

[Selection: locks the account/node for an [Assignment: organization-defined time period], 

delays next login prompt according to [Assignment: organization-defined delay 

algorithm.]] when the maximum number of unsuccessful attempts is exceeded. 

Supplemental Guidance: Due to the potential for denial of service, automatic lockouts 

initiated by the information system are usually temporary and automatically release after 

a predetermined time period established by the organization. 

AC-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the maximum number of consecutive invalid access 

attempts to the information system by a user and the time period in which the 

consecutive invalid access attempts occur; 

(ii) the information system enforces the organization-defined limit of consecutive invalid 

access attempts by a user during the organization-defined time period; 

(iii) the organization defines the time period for lock out mode or delay period; 

(iv) the organization selects either a lock out mode for the organization-defined time 

period or delays next login prompt for the organization-defined delay period for 

information system responses to consecutive invalid access attempts; 

(v) the information system enforces the organization-selected lock out mode or delayed 

login prompt. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful logon attempts; 

information system security plan; information system configuration settings and associated 

documentation; information system audit records; other relevant documents or records]. (L)

(M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful 

login attempts]. (H)

APPENDIX F - AC PAGE F-15 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-7(1) UNSUCCESSFUL LOGIN ATTEMPTS 

Control Enhancement: 

The information system automatically locks the account/node until released by an 

administrator when the maximum number of unsuccessful attempts is exceeded. 

AC-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system automatically locks the account/node until released 

by an administrator when the maximum number of unsuccessful login attempts is 

exceeded. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing unsuccessful logon attempts; 

information system design documentation; information system configuration settings and 

associated documentation; list of information system accounts; information system audit 

records; other relevant documents or records]. 

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for unsuccessful 

login attempts]. 

APPENDIX F - AC PAGE F-16 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-8 SYSTEM USE NOTIFICATION 

Control: The information system displays an approved, system use notification message 

before granting system access informing potential users: (i) that the user is accessing a 

U.S. Government information system; (ii) that system usage may be monitored, recorded, 

and subject to audit; (iii) that unauthorized use of the system is prohibited and subject to 

criminal and civil penalties; and (iv) that use of the system indicates consent to 

monitoring and recording. The system use notification message provides appropriate 

privacy and security notices (based on associated privacy and security policies or 

summaries) and remains on the screen until the user takes explicit actions to log on to the 

information system. 

Supplemental Guidance: Privacy and security policies are consistent with applicable laws, 

Executive Orders, directives, policies, regulations, standards, and guidance. System use 

notification messages can be implemented in the form of warning banners displayed 

when individuals log in to the information system. For publicly accessible systems: (i) 

the system use information is available and when appropriate, is displayed before 

granting access; (ii) any references to monitoring, recording, or auditing are in keeping 

with privacy accommodations for such systems that generally prohibit those activities; 

and (iii) the notice given to public users of the information system includes a description 

of the authorized uses of the system. 

AC-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system displays a system use notification message before granting 

system access informing potential users: 

 - that the user is accessing a U.S. Government information system; 

 - that system usage may be monitored, recorded, and subject to audit; 

 - that unauthorized use of the system is prohibited and subject to criminal and 

 civil penalties; 

 - that use of the system indicates consent to monitoring and recording; 

(ii) the system use notification message provides appropriate privacy and security 

notices (based on associated privacy and security policies or summaries). 

(iii) the organization approves the information system use notification message before 

its use; and 

(iv) the system use notification message remains on the screen until the user takes 

explicit actions to log on to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing system use notification; 

information system notification messages; information system configuration settings and 

associated documentation; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for system use 

notification]. (H)

APPENDIX F - AC PAGE F-17 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-9 PREVIOUS LOGON NOTIFICATION 

Control: The information system notifies the user, upon successful logon, of the date and 

time of the last logon, and the number of unsuccessful logon attempts since the last 

successful logon. 

Supplemental Guidance: None. 

AC-9.1 ASSESSMENT OBJECTIVE:

Determine if the information system, upon successful logon, displays the date and time of 

the last logon and the number of unsuccessful logon attempts since the last successful 

logon. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing previous logon notification; 

information system notification messages; information system design documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. 

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for previous 

logon notification]. 

APPENDIX F - AC PAGE F-18 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-10 CONCURRENT SESSION CONTROL 

Control: The information system limits the number of concurrent sessions for any user to 

[Assignment: organization-defined number of sessions]. 

Supplemental Guidance: None. 

AC-10.1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines the maximum number of concurrent sessions for 

information system users; and 

(ii) the information system limits the number of concurrent sessions for users to the 

organization-defined number of sessions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing concurrent session control; 

information system configuration settings and associated documentation; information 

system security plan; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for concurrent 

session control]. (H)

APPENDIX F - AC PAGE F-19 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-11 SESSION LOCK 

Control: The information system prevents further access to the system by initiating a 

session lock after [Assignment: organization-defined time period] of inactivity, and the 

session lock remains in effect until the user reestablishes access using appropriate 

identification and authentication procedures. 

Supplemental Guidance: Users can directly initiate session lock mechanisms. A session 

lock is not a substitute for logging out of the information system. Organization-defined 

time periods of inactivity comply with federal policy; for example, in accordance with 

OMB Memorandum 06-16, the organization-defined time period is no greater than thirty 

minutes for remote access and portable devices. 

AC-11.1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines the time period of user inactivity that initiates a session 

lock within the information system; 

(ii) the information system initiates a session lock after the organization-defined time 

period of inactivity; and 

(iii) the information system maintains the session lock until the user reestablishes access 

using appropriate identification and authentication procedures. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing session lock; information 

system design documentation; information system configuration settings and associated 

documentation; information system security plan; other relevant documents or records]. (M)

(H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for session lock]. 

(H)

APPENDIX F - AC PAGE F-20 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-12 SESSION TERMINATION 

Control: The information system automatically terminates a remote session after 

[Assignment: organization-defined time period] of inactivity. 

Supplemental Guidance: A remote session is initiated whenever an organizational 

information system is accessed by a user (or an information system) communicating 

through an external, non-organization-controlled network (e.g., the Internet). 

AC-12.1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines the time period of user inactivity that initiates a remote 

session termination within the information system; and 

(ii) the information system automatically terminates a remote session after the 

organization-defined time period of inactivity. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing session termination; 

information system design documentation; information system configuration settings and 

associated documentation; information system security plan; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for session 

termination]. (H)

APPENDIX F - AC PAGE F-21 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-12(1) SESSION TERMINATION 

Control Enhancement:

Automatic session termination applies to local and remote sessions. 

AC-12(1).1 ASSESSMENT OBJECTIVE:

Determine if automatic session termination applies to local and remote sessions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing session termination; 

information system design documentation; information system configuration settings and 

associated documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for session 

termination]. (H)

APPENDIX F - AC PAGE F-22 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-13 SUPERVISION AND REVIEW — ACCESS CONTROL 

Control: The organization supervises and reviews the activities of users with respect to the 

enforcement and usage of information system access controls. 

Supplemental Guidance: The organization reviews audit records (e.g., user activity logs) for 

inappropriate activities in accordance with organizational procedures. The organization 

investigates any unusual information system-related activities and periodically reviews 

changes to access authorizations. The organization reviews more frequently the activities 

of users with significant information system roles and responsibilities. The extent of the 

audit record reviews is based on the FIPS 199 impact level of the information system. 

For example, for low-impact systems, it is not intended that security logs be reviewed 

frequently for every workstation, but rather at central points such as a web proxy or email 

servers and when specific circumstances warrant review of other audit records. NIST 

Special Publication 800-92 provides guidance on computer security log management. 

AC-13.1 ASSESSMENT OBJECTIVE:

Determine if the organization supervises and reviews the activities of users with respect 

to the enforcement and usage of information system access controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing supervision and review of 

access control enforcement and usage; organizational records of supervisory notices of 

disciplinary actions to users; information system exception reports; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with supervisory and access control 

responsibilities]. (H)

APPENDIX F - AC PAGE F-23 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-13 SUPERVISION AND REVIEW — ACCESS CONTROL 

Control Enhancement: 

(1) The organization employs automated mechanisms to facilitate the review of user activities. 

AC-13(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms within the information 

system to support and facilitate the review of user activities. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing supervision and review of 

access control enforcement and usage; information system design documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms supporting the access control policy for supervision and 

review of user activities]. (H)

APPENDIX F - AC PAGE F-24 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION 

Control: The organization identifies and documents specific user actions that can be 

performed on the information system without identification or authentication. 

Supplemental Guidance: The organization allows limited user activity without identification 

and authentication for public websites or other publicly available information systems 

(e.g., individuals accessing a federal information system at http://www.firstgov.gov). 

Related security control: IA-2. 

AC-14.1 ASSESSMENT OBJECTIVE:

Determine if the organization identifies and documents specific user actions that can be 

performed on the information system without identification or authentication. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing permitted actions without 

identification and authentication; information system configuration settings and associated 

documentation; information system security plan; other relevant documents or records]. (L)

(M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for permitted 

actions without identification and authentication]. (H)

APPENDIX F - AC PAGE F-25 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-14(1) PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION 

Control Enhancement: 

The organization permits actions to be performed without identification and authentication 

only to the extent necessary to accomplish mission objectives. 

AC-14(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization permits actions to be performed without identification and 

authentication only to the extent necessary to accomplish mission objectives. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing permitted actions without 

identification and authentication; information system configuration settings and associated 

documentation; list of organization-defined actions that can be performed without 

identification and authentication; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining permitted actions 

without identification and authentication]. (H)

APPENDIX F - AC PAGE F-26 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-15 AUTOMATED MARKING 

Control: The information system marks output using standard naming conventions to 

identify any special dissemination, handling, or distribution instructions.

Supplemental Guidance: Automated marking refers to markings employed on external 

media (e.g., hardcopy documents output from the information system). The markings 

used in external marking are distinguished from the labels used on internal data structures 

described in AC-16. 

AC-15.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies standard naming conventions for information system 

output; and 

(ii) the information system marks output using standard naming conventions to identify 

any special dissemination, handling, or distribution instructions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures for addressing automated marking of 

information system output; information system output; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining special 

dissemination, handling, and marking instructions for information system output]. (H)

Test: [SELECT FROM: Automated mechanisms implementing automated marking of information system 

output]. (H)

APPENDIX F - AC PAGE F-27 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-16 AUTOMATED LABELING 

Control: The information system appropriately labels information in storage, in process, 

and in transmission. 

Supplemental Guidance: Automated labeling refers to labels employed on internal data 

structures (e.g., records, files) within the information system. Information labeling is 

accomplished in accordance with: (i) access control requirements; (ii) special 

dissemination, handling, or distribution instructions; or (iii) as otherwise required to 

enforce information system security policy. 

AC-16.1 ASSESSMENT OBJECTIVE:

Determine if the information system appropriately labels information in storage, in 

process, and in transmission. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing automated (internal) labeling 

of information within the information system; information system design documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. 

Test: [SELECT FROM: Automated mechanisms implementing automated (internal) labeling within the 

information system]. 

APPENDIX F - AC PAGE F-28 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-17 REMOTE ACCESS 

Control: The organization authorizes, monitors, and controls all methods of remote access 

to the information system. 

Supplemental Guidance: Remote access is any access to an organizational information 

system by a user (or an information system) communicating through an external, nonorganization-controlled network (e.g., the Internet). Examples of remote access methods 

include dial-up, broadband, and wireless. Remote access controls are applicable to 

information systems other than public web servers or systems specifically designed for 

public access. The organization restricts access achieved through dial-up connections 

(e.g., limiting dial-up access based upon source of request) or protects against 

unauthorized connections or subversion of authorized connections (e.g., using virtual 

private network technology). NIST Special Publication 800-63 provides guidance on 

remote electronic authentication. If the federal Personal Identity Verification (PIV) 

credential is used as an identification token where cryptographic token-based access 

control is employed, the access control system conforms to the requirements of FIPS 201 

and NIST Special Publications 800-73 and 800-78. NIST Special Publication 800-77 

provides guidance on IPsec-based virtual private networks. Related security control: IA2. 

AC-17.1 ASSESSMENT OBJECTIVE:

Determine if the organization documents, monitors, and controls all methods of remote 

access to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the 

information system; information system configuration settings and associated 

documentation; information system audit records; other relevant documents or records]. (L)

(M) (H)

Interview: [SELECT FROM: Organizational personnel with remote access authorization, monitoring, and 

control responsibilities]. (M) (H)

APPENDIX F - AC PAGE F-29 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-17(1) REMOTE ACCESS 

Control Enhancement: 

The organization employs automated mechanisms to facilitate the monitoring and control of 

remote access methods. 

AC-17(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs automated mechanisms to facilitate the 

monitoring and control of remote access methods. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the 

information system; information system configuration settings and associated 

documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote 

access]. (H)

AC-17(2) REMOTE ACCESS 

Control Enhancement: 

The organization uses cryptography to protect the confidentiality and integrity of remote 

access sessions. 

AC-17(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs cryptography to protect the confidentiality 

and integrity of remote access sessions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the 

information system; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing cryptographic protections for remote 

access]. (H)

APPENDIX F - AC PAGE F-30 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-17(3) REMOTE ACCESS 

Control Enhancement: 

The organization controls all remote accesses through a limited number of managed access 

control points. 

AC-17(3).1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines managed access control points for remote access to the 

information system; and 

(ii) the information system controls all remote accesses through a limited number of 

managed access control points. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the 

information system; information system design documentation; list of managed access 

control points; information system configuration settings and associated documentation; 

information system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote 

access]. (H)

AC-17(4) REMOTE ACCESS 

Control Enhancement: 

The organization permits remote access for privileged functions only for compelling 

operational needs and documents the rationale for such access in the security plan for the 

information system. 

AC-17(4).1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines the situations and compelling operational needs when 

remote access to privileged functions on the information system is allowed; and 

(ii) the organization permits remote access for privileged functions only for compelling 

operational needs and documents the rationale for such access in the security plan 

for the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing remote access to the 

information system; information system configuration settings and associated 

documentation; information system security plan; information system audit records; other 

relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for remote 

access]. (H)

APPENDIX F - AC PAGE F-31 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-18 WIRELESS ACCESS RESTRICTIONS 

Control: The organization: (i) establishes usage restrictions and implementation guidance 

for wireless technologies; and (ii) authorizes, monitors, controls wireless access to the 

information system.

Supplemental Guidance: NIST Special Publications 800-48 and 800-97 provide guidance 

on wireless network security. NIST Special Publication 800-94 provides guidance on 

wireless intrusion detection and prevention. 

AC-18.1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization establishes usage restrictions and implementation guidance for 

wireless technologies; 

(ii) the organization authorizes, monitors, and controls wireless access to the 

information system; and 

(iii) the wireless access restrictions are consistent with NIST Special Publications 800-

48 and 800-97. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and 

usage (including restrictions); NIST Special Publications 800-48 and 800-97; activities 

related to wireless authorization, monitoring, and control; information system audit records; 

other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Wireless access usage and restrictions]. (M) (H)

APPENDIX F - AC PAGE F-32 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-18(1) WIRELESS ACCESS RESTRICTIONS 

Control Enhancement: 

The organization uses authentication and encryption to protect wireless access to the 

information system. 

AC-18(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization uses authentication and encryption to protect wireless 

access to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and 

usage (including restrictions); information system design documentation; information 

system configuration settings and associated documentation; information system audit 

records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for wireless 

access to the information system]. (H)

AC-18(2) WIRELESS ACCESS RESTRICTIONS 

Control Enhancement: 

The organization scans for unauthorized wireless access points [Assignment: organizationdefined frequency] and takes appropriate action if such an access points are discovered. 

Enhancement Supplemental Guidance: Organizations conduct a thorough scan for 

unauthorized wireless access points in facilities containing high-impact information 

systems. The scan is not limited to only those areas within the facility containing the 

high-impact information systems. 

AC-18(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of scans for unauthorized wireless access 

points; and 

(ii) the organization scans for unauthorized wireless access points in accordance with 

organization-defined frequency and takes appropriate action if such an access 

points are discovered. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and 

usage (including restrictions); wireless scanning reports; other relevant documents or 

records]. (H)

Test: [SELECT FROM: Scanning procedure for unauthorized wireless access points]. (H)

APPENDIX F - AC PAGE F-33 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-19 ACCESS CONTROL FOR PORTABLE AND MOBILE DEVICES 

Control: The organization: (i) establishes usage restrictions and implementation guidance 

for organization-controlled portable and mobile devices; and (ii) authorizes, monitors, and 

controls device access to organizational information systems. 

Supplemental Guidance: Portable and mobile devices (e.g., notebook computers, personal 

digital assistants, cellular telephones, and other computing and communications devices 

with network connectivity and the capability of periodically operating in different 

physical locations) are only allowed access to organizational information systems in 

accordance with organizational security policies and procedures. Security policies and 

procedures include device identification and authentication, implementation of mandatory 

protective software (e.g., malicious code detection, firewall), configuration management, 

scanning devices for malicious code, updating virus protection software, scanning for 

critical software updates and patches, conducting primary operating system (and possibly 

other resident software) integrity checks, and disabling unnecessary hardware (e.g., 

wireless, infrared). Protecting information residing on portable and mobile devices (e.g., 

employing cryptographic mechanisms to provide confidentiality and integrity protections 

during storage and while in transit when outside of controlled areas) is covered in the 

media protection family. Related security controls: MP-4, MP-5. 

AC-19.1 ASSESSMENT OBJECTIVE:

 Determine if: 

(i) the organization defines a mandatory suite of protective software and security 

protocols to be installed on and executed by the information system and portable 

and mobile devices; 

(ii) the organization establishes usage restrictions and implementation guidance for 

organization-controlled portable and mobile devices; and 

(iii) the organization authorizes, monitors, and controls device access to organizational 

information systems. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable 

and mobile devices; information system design documentation; information system 

configuration settings and associated documentation; information system audit records; 

other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel who use portable and mobile devices to access 

the information system]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and 

mobile devices]. (H)

APPENDIX F - AC PAGE F-34 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-20 USE OF EXTERNAL INFORMATION SYSTEMS 

Control: The organization establishes terms and conditions for authorized individuals to: 

(i) access the information system from an external information system; and (ii) process, 

store, and/or transmit organization-controlled information using an external information 

system. 

Supplemental Guidance: External information systems are information systems or 

components of information systems that are outside of the accreditation boundary 

established by the organization and for which the organization typically has no direct 

control over the application of required security controls or the assessment of security 

control effectiveness. External information systems include, but are not limited to, 

personally owned information systems (e.g., computers, cellular telephones, or personal 

digital assistants); privately owned computing and communications devices resident in 

commercial or public facilities (e.g., hotels, convention centers, or airports); information 

systems owned or controlled by nonfederal governmental organizations; and federal 

information systems that are not owned by, operated by, or under the direct control of the 

organization. 

Authorized individuals include organizational personnel, contractors, or any other 

individuals with authorized access to the organizational information system. This control 

does not apply to the use of external information systems to access organizational 

information systems and information that are intended for public access (e.g., individuals 

accessing federal information through public interfaces to organizational information 

systems). The organization establishes terms and conditions for the use of external 

information systems in accordance with organizational security policies and procedures. 

The terms and conditions address as a minimum; (i) the types of applications that can be 

accessed on the organizational information system from the external information system; 

and (ii) the maximum FIPS 199 security category of information that can be processed, 

stored, and transmitted on the external information system. 

APPENDIX F - AC PAGE F-35 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

AC-20.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the types of applications that can be accessed from the 

external information system; 

(ii) the organization defines the maximum FIPS 199 security category of information 

that can be processed, stored, and transmitted on the external information system; 

and 

(iii) the organization establishes terms and conditions for authorized individuals to 

access the information system from an external information system that include the 

types of applications that can be accessed on the organizational information system 

from the external information system and the maximum FIPS 199 security category 

of information that can be processed, stored, and transmitted on the external 

information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information 

systems; external information systems terms and conditions; list of types of applications 

accessible from external information systems; maximum FIPS 199 impact level for 

information processed, stored, or transmitted on external information systems; information 

system configuration settings and associated documentation; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel who use external information systems to access 

the information system]. M) (H)

APPENDIX F - AC PAGE F-36 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - AC PAGE F-37 

FAMILY: ACCESS CONTROL CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AC-20(1) USE OF EXTERNAL INFORMATION SYSTEMS 

Control Enhancement:

The organization prohibits authorized individuals from using an external information system to 

access the information system or to process, store, or transmit organization-controlled 

information except in situations where the organization: (i) can verify the employment of 

required security controls on the external system as specified in the organization’s 

information security policy and system security plan; or (ii) has approved information system 

connection or processing agreements with the organizational entity hosting the external 

information system. 

AC-20(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization prohibits authorized individuals from using an external 

information system to access the information system or to process, store, or transmit 

organization-controlled information except in situations where the organization: 

- verifies, for authorized exceptions, the employment of required security controls on 

the external system as specified in the organization’s information security policy and 

system security plan when allowing connections to the external information system; 

or 

- approves, for authorized exceptions, information system connection or processing 

agreements with the organizational entity hosting the external information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information 

systems; information system security plan; information system configuration settings and 

associated documentation; information system connection or processing agreements; 

account management documents; other relevant documents or records]. (M) (H) 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL 

 ASSESSMENT PROCEDURE

AT-1 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES 

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, security awareness and training policy that addresses purpose, 

scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the security awareness and training policy and associated 

security awareness and training controls. 

Supplemental Guidance: The security awareness and training policy and procedures are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The security awareness and training policy can be included as 

part of the general information security policy for the organization. Security awareness 

and training procedures can be developed for the security program in general, and for a 

particular information system, when required. NIST Special Publications 800-16 and 

800-50 provide guidance on security awareness and training. NIST Special Publication 

800-12 provides guidance on security policies and procedures. 

AT-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents security awareness and training policy 

and procedures; 

(ii) the organization disseminates security awareness and training policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review security awareness 

and training policy and procedures; and 

(iv) the organization updates security awareness and training policy and procedures 

when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security awareness and training 

responsibilities]. (H)

APPENDIX F - AT PAGE F-38 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

 ASSESSMENT PROCEDURE

AT-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the security awareness and training policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the security awareness and training policy is consistent with the organization’s 

mission and functions and with applicable laws, directives, policies, regulations, 

standards, and guidance; and 

(iii) the security awareness and training procedures address all areas identified in the 

security awareness and training policy and address achieving policy-compliant 

implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security awareness and training 

responsibilities]. (H)

APPENDIX F - AT PAGE F-39 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

AT-2 SECURITY AWARENESS 

Control: The organization provides basic security awareness training to all information 

system users (including managers and senior executives) before authorizing access to the 

system, when required by system changes, and [Assignment: organization-defined 

frequency, at least annually] thereafter. 

Supplemental Guidance: The organization determines the appropriate content of security 

awareness training based on the specific requirements of the organization and the 

information systems to which personnel have authorized access. The organization’s 

security awareness program is consistent with the requirements contained in C.F.R. Part 5 

Subpart C (5 C.F.R 930.301) and with the guidance in NIST Special Publication 800-50. 

AT-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization provides basic security awareness training to all information 

system users (including managers and senior executives) before authorizing access 

to the system and when required by system changes; 

(ii) the security awareness training is consistent with applicable regulations and NIST 

Special Publication 800-50; 

(iii) the security awareness and training materials address the specific requirements of 

the organization and the information systems to which personnel have authorized 

access; 

(iv) the organization defines the frequency of refresher security awareness training; and 

(v) the organization provides refresher security awareness training in accordance with 

organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy; procedures addressing security 

awareness training implementation; NIST Special Publication 800-50; appropriate codes of 

federal regulations; security awareness training curriculum; security awareness training 

materials; information system security plan; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel comprising the general information system user 

community]. (H)

APPENDIX F - AT PAGE F-40 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

AT-3 SECURITY TRAINING 

Control: The organization identifies personnel that have significant information system 

security roles and responsibilities during the system development life cycle, documents 

those roles and responsibilities, and provides appropriate information system security 

training: (i) before authorizing access to the system or performing assigned duties; (ii) 

when required by system changes; and (iii) [Assignment: organization-defined frequency] 

thereafter. 

Supplemental Guidance: The organization determines the appropriate content of security 

training based on the specific requirements of the organization and the information 

systems to which personnel have authorized access. In addition, the organization 

provides system managers, system and network administrators, and other personnel 

having access to system-level software, adequate technical training to perform their 

assigned duties. The organization’s security training program is consistent with the 

requirements contained in C.F.R. Part 5 Subpart C (5 C.F.R 930.301) and with the 

guidance in NIST Special Publication 800-50. 

AT-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies personnel with significant information system security 

responsibilities and documents those roles and responsibilities; 

(ii) the organization provides security training to personnel with identified information 

system security roles and responsibilities before authorizing access to the system or 

performing assigned duties and when required by system changes; 

(iii) the security training materials address the procedures and activities necessary to 

fulfill the organization-defined roles and responsibilities for information system 

security; 

(iv) the security training is consistent with applicable regulations and NIST Special 

Publication 800-50; 

(v) the organization defines the frequency of refresher security training; and 

(vi) the organization provides refresher security training in accordance with 

organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy; procedures addressing security 

training implementation; NIST Special Publication 800-50; codes of federal regulations; 

security training curriculum; security training materials; information system security plan; 

other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with significant information system security 

responsibilities]. (H)

APPENDIX F - AT PAGE F-41 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

AT-4 SECURITY TRAINING RECORDS 

Control: The organization documents and monitors individual information system security 

training activities including basic security awareness training and specific information 

system security training. 

Supplemental Guidance: None. 

AT-4.1 ASSESSMENT OBJECTIVE:

Determine if the organization monitors and documents basic security awareness training 

and specific information system security training. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy; procedures addressing security 

training records; security awareness and training records; other relevant documents or 

records]. (L) (M) (H)

APPENDIX F - AT PAGE F-42 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - AT PAGE F-43 

FAMILY: AWARENESS AND TRAINING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

AT-5 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS 

Control: The organization establishes and maintains contacts with special interest groups, 

specialized forums, professional associations, news groups, and/or peer groups of security 

professionals in similar organizations to stay up to date with the latest recommended 

security practices, techniques, and technologies and to share the latest security-related 

information including threats, vulnerabilities, and incidents. 

Supplemental Guidance: To facilitate ongoing security education and training for 

organizational personnel in an environment of rapid technology changes and dynamic 

threats, the organization establishes and institutionalizes contacts with selected groups 

and associations within the security community. The groups and associations selected are 

in keeping with the organization’s mission requirements. Information sharing activities 

regarding threats, vulnerabilities, and incidents related to information systems are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. 

AT-5.1 ASSESSMENT OBJECTIVE:

Determine if the organization establishes and maintains contact with special interest 

groups, specialized forums, or professional associations to keep current with state-of-thepractice security techniques and technologies and to share security-related information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy; procedures addressing contacts 

with security groups and associations; list of organization-defined key contacts to obtain 

ongoing information system security knowledge, expertise, and general information; other 

relevant documents or records]. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-1 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, audit and accountability policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the audit and accountability policy and associated audit and accountability controls. 

Supplemental Guidance: The audit and accountability policy and procedures are consistent 

with applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The audit and accountability policy can be included as part of the general 

information security policy for the organization. Audit and accountability procedures can 

be developed for the security program in general, and for a particular information system, 

when required. NIST Special Publication 800-12 provides guidance on security policies 

and procedures. 

AU-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents audit and accountability policy and 

procedures; 

(ii) the organization disseminates audit and accountability policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review audit and 

accountability policy and procedures; and 

(iv) the organization updates audit and accountability policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities]. (H)

AU-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the audit and accountability policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the audit and accountability policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the audit and accountability procedures address all areas identified in the audit and 

accountability policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities]. (H)

APPENDIX F - AU PAGE F-44 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-2 AUDITABLE EVENTS 

Control: The information system generates audit records for the following events: 

[Assignment: organization-defined auditable events]. 

Supplemental Guidance: The purpose of this control is to identify important events which 

need to be audited as significant and relevant to the security of the information system. 

The organization specifies which information system components carry out auditing 

activities. Auditing activity can affect information system performance. Therefore, the 

organization decides, based upon a risk assessment, which events require auditing on a 

continuous basis and which events require auditing in response to specific situations. 

Audit records can be generated at various levels of abstraction, including at the packet 

level as information traverses the network. Selecting the right level of abstraction for 

audit record generation is a critical aspect of an audit capability and can facilitate the 

identification of root causes to problems. Additionally, the security audit function is 

coordinated with the network health and status monitoring function to enhance the mutual 

support between the two functions by the selection of information to be recorded by each 

function. The checklists and configuration guides at http://csrc.nist.gov/pcig/cig.html 

provide recommended lists of auditable events. The organization defines auditable events 

that are adequate to support after-the-fact investigations of security incidents. NIST 

Special Publication 800-92 provides guidance on computer security log management. 

AU-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines information system auditable events; 

(ii) the organization-defined auditable events are adequate to support after-the-fact 

investigations of security incidents; and 

(iii) the information system generates audit records for the organization-defined 

auditable events. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing auditable events; 

information system security plan; information system configuration settings and associated 

documentation; information system audit records; other relevant documents or records]. (L)

(M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information system auditing of 

organization-defined auditable events]. (H)

APPENDIX F - AU PAGE F-45 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-2(1) AUDITABLE EVENTS 

Control Enhancement: 

The information system provides the capability to compile audit records from multiple 

components throughout the system into a systemwide (logical or physical), time-correlated 

audit trail. 

AU-2(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the components of the information system that generate 

audit records; and 

(ii) the information system compiles audit records from the organization-defined 

(multiple) components within the information system into a systemwide (logical or 

physical), time-correlated audit trail. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing auditable events; 

information system design documentation; information system configuration settings and 

associated documentation; list of organization-defined auditable events; information system 

audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing a system-wide auditing capability]. (H)

AU-2(2) AUDITABLE EVENTS 

Control Enhancement: 

The information system provides the capability to manage the selection of events to be 

audited by individual components of the system. 

AU-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to manage the selection of 

events to be audited by individual components of the system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing auditable events; 

information system design documentation; information system configuration settings and 

associated documentation; list of organization-defined auditable events; information system 

audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing Information system auditing for the 

specified components of the information system]. (H)

APPENDIX F - AU PAGE F-46 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-2(3) AUDITABLE EVENTS 

Control Enhancement: 

The organization periodically reviews and updates the list of organization-defined auditable 

events. 

AU-2(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization periodically reviews and updates the list of organizationdefined auditable events. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing auditable events; list 

of organization-defined auditable events; information system audit records; information 

system incident reports; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with auditing and accountability responsibilities]. 

(H)

APPENDIX F - AU PAGE F-47 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-3 CONTENT OF AUDIT RECORDS 

Control: The information system produces audit records that contain sufficient information 

to establish what events occurred, the sources of the events, and the outcomes of the 

events. 

Supplemental Guidance: Audit record content includes, for most audit records: (i) date and 

time of the event; (ii) the component of the information system (e.g., software 

component, hardware component) where the event occurred; (iii) type of event; (iv) 

user/subject identity; and (v) the outcome (success or failure) of the event. NIST Special 

Publication 800-92 provides guidance on computer security log management. 

AU-3.1 ASSESSMENT OBJECTIVE:

Determine if the information system audit records capture sufficient information to 

establish what events occurred, the sources of the events, and the outcomes of the events. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing content of audit 

records; list of organization-defined auditable events; information system audit records; 

information system incident reports; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information system auditing of auditable 

events]. (H)

APPENDIX F - AU PAGE F-48 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-3(1) CONTENT OF AUDIT RECORDS 

Control Enhancement: 

The information system provides the capability to include additional, more detailed 

information in the audit records for audit events identified by type, location, or subject. 

AU-3(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to include additional, more 

detailed information in the audit records for audit events identified by type, location, or 

subject. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing content of audit 

records; information system design documentation; information system security plan; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

Test: [SELECT FROM: Information system audit capability to include more detailed information in audit 

records for audit events identified by type, location, or subject]. (H)

AU-3(2) CONTENT OF AUDIT RECORDS 

Control Enhancement: 

The information system provides the capability to centrally manage the content of audit 

records generated by individual components throughout the system. 

AU-3(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to centrally manage the 

content of audit records generated from multiple components throughout the system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing content of audit 

records; information system design documentation; list of organization-defined auditable 

events; information system configuration settings and associated documentation; 

information system audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing information system auditing with central 

management capability]. (H)

APPENDIX F - AU PAGE F-49 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-4 AUDIT STORAGE CAPACITY 

Control: The organization allocates sufficient audit record storage capacity and configures 

auditing to reduce the likelihood of such capacity being exceeded.

Supplemental Guidance: The organization provides sufficient audit storage capacity, taking 

into account the auditing to be performed and the online audit processing requirements. 

Related security controls: AU-2, AU-5, AU-6, AU-7, SI-4. 

AU-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines audit record storage capacity for the information system 

components that generate audit records; and 

(ii) the organization establishes information system configuration settings to reduce the 

likelihood of the audit record storage capacity being exceeded. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit storage 

capacity; information system design documentation; organization-defined audit record 

storage capacity for information system components generating audit records; list of 

organization-defined auditable events; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. (L) (M) (H)

APPENDIX F - AU PAGE F-50 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-5 RESPONSE TO AUDIT PROCESSING FAILURES 

Control: The information system alerts appropriate organizational officials in the event of 

an audit processing failure and takes the following additional actions: [Assignment: 

organization-defined actions to be taken (e.g., shut down information system, overwrite 

oldest audit records, stop generating audit records)]. 

Supplemental Guidance: Audit processing failures include, for example, software/hardware 

errors, failures in the audit capturing mechanisms, and audit storage capacity being 

reached or exceeded. Related security control: AU-4. 

AU-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines actions to be taken in the event of an audit processing 

failure; 

(ii) the organization defines personnel to be notified in case of an audit processing 

failure; and 

(iii) the information system alerts appropriate organizational officials and takes any 

additional organization-defined actions in the event of an audit failure or audit 

storage capacity being reached. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit 

processing failures; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; list of 

personnel to be notified in case of an audit processing failure; information system audit 

records; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information system response to audit 

processing failures]. (H)

APPENDIX F - AU PAGE F-51 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-5(1) RESPONSE TO AUDIT PROCESSING FAILURES 

Control Enhancement:

The information system provides a warning when allocated audit record storage volume 

reaches [Assignment: organization-defined percentage of maximum audit record storage 

capacity]. 

AU-5(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines percentage of maximum audit record storage capacity; 

(ii) the information system provides a warning when the allocated audit record storage 

volume reaches the organization-defined percentage of maximum audit record 

storage capacity. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit 

processing failures; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; information 

system audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing audit storage limit warnings]. (H)

AU-5(2) RESPONSE TO AUDIT PROCESSING FAILURES 

Control Enhancement:

The information system provides a real-time alert when the following audit failure events 

occur: [Assignment: organization-defined audit failure events requiring real-time alerts]. 

AU-5(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines audit failure events requiring real-time alerts; and 

(ii) the information system provides a real-time alert when organization-defined audit 

failure events occur. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit 

processing failures; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; information 

system audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing real time audit alerts]. (H)

APPENDIX F - AU PAGE F-52 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-6 AUDIT MONITORING, ANALYSIS, AND REPORTING 

Control: The organization regularly reviews/analyzes information system audit records for 

indications of inappropriate or unusual activity, investigates suspicious activity or 

suspected violations, reports findings to appropriate officials, and takes necessary actions. 

Supplemental Guidance: Organizations increase the level of audit monitoring and analysis 

activity within the information system whenever there is an indication of increased risk to 

organizational operations, organizational assets, or individuals based on law enforcement 

information, intelligence information, or other credible sources of information. 

AU-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization regularly reviews/analyzes audit records for indications of 

inappropriate or unusual activity; 

(ii) the organization investigates suspicious activity or suspected violations; 

(iii) the organization reports findings of inappropriate/unusual activities, suspicious 

behavior, or suspected violations to appropriate officials; and 

(iv) the organization takes necessary actions in response to the reviews/analyses of audit 

records. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit monitoring, 

analysis, and reporting; reports of audit findings; records of actions taken in response to 

reviews/analyses of audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Information system audit monitoring, analysis, and reporting capability]. (H)

AU-6.2 ASSESSMENT OBJECTIVE:

Determine if the organization increases the level of audit monitoring and analysis activity 

whenever there is increased risk to organizational operations and assets, or to 

individuals, based on information from law enforcement organizations, the intelligence 

community, or other credible sources. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit monitoring, 

analysis, and reporting; threat information documentation from law enforcement, 

intelligence community, or other sources; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system audit monitoring, 

analysis, and reporting responsibilities]. (H)

APPENDIX F - AU PAGE F-53 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-6(1) AUDIT MONITORING, ANALYSIS, AND REPORTING 

Control Enhancement: 

The organization employs automated mechanisms to integrate audit monitoring, analysis, and 

reporting into an overall process for investigation and response to suspicious activities. 

AU-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to integrate audit 

monitoring, analysis, and reporting into an overall process for investigation and response 

to suspicious activities. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit monitoring, 

analysis, and reporting; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (H)

Test: [SELECT FROM: Automated mechanisms integrating audit monitoring, analysis, and reporting into 

an organizational process for investigation and response to suspicious activities]. (H)

AU-6(2) AUDIT MONITORING, ANALYSIS, AND REPORTING 

Control Enhancement: 

The organization employs automated mechanisms to alert security personnel of the following 

inappropriate or unusual activities with security implications: [Assignment: organizationdefined list of inappropriate or unusual activities that are to result in alerts]. 

AU-6(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines inappropriate or unusual activities with security 

implications; and 

(ii) the organization employs automated mechanisms to alert security personnel of the 

occurrence of any organization-defined inappropriate or unusual activities with 

security implications. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit monitoring, 

analysis, and reporting; information system design documentation; information system 

configuration settings and associated documentation; information system security plan; 

information system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing security alerts]. (M) (H)

APPENDIX F - AU PAGE F-54 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-7 AUDIT REDUCTION AND REPORT GENERATION 

Control: The information system provides an audit reduction and report generation 

capability. 

Supplemental Guidance: Audit reduction, review, and reporting tools support after-the-fact 

investigations of security incidents without altering original audit records. 

AU-7.1 ASSESSMENT OBJECTIVE:

Determine if the information system provides an audit reduction and report generation 

capability. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit reduction and 

report generation; information system design documentation; audit reduction, review, and 

reporting tools; information system audit records; other relevant documents or records]. (M)

(H)

Interview: [SELECT FROM: Organizational personnel with information system audit monitoring, 

analysis, and reporting responsibilities]. (H)

Test: [SELECT FROM: Audit reduction and report generation capability]. (M) (H)

APPENDIX F - AU PAGE F-55 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-7(1) AUDIT REDUCTION AND REPORT GENERATION 

Control Enhancement: 

The information system provides the capability to automatically process audit records for 

events of interest based upon selectable, event criteria. 

AU-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to automatically process 

audit records for events of interest based upon selectable, event criteria. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit reduction and 

report generation; information system design documentation; information system 

configuration settings and associated documentation; audit reduction, review, and reporting 

tools; information system audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Audit reduction and report generation capability]. (H)

APPENDIX F - AU PAGE F-56 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-8 TIME STAMPS 

Control: The information system provides time stamps for use in audit record generation. 

Supplemental Guidance: Time stamps (including date and time) of audit records are 

generated using internal system clocks. 

AU-8.1 ASSESSMENT OBJECTIVE:

Determine if the information system provides time stamps for use in audit record 

generation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing time stamp 

generation; information system design documentation; information system configuration 

settings and associated documentation; information system audit records; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing time stamp generation]. (M) (H)

APPENDIX F - AU PAGE F-57 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-8(1) TIME STAMPS 

Control Enhancement:

The organization synchronizes internal information system clocks [Assignment: organizationdefined frequency]. 

AU-8(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of internal clock synchronization for the 

information system; and 

(ii) the organization synchronizes internal information system clocks periodically in 

accordance with organization-defined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing time stamp 

generation; information system security plan; information system design documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing internal information system clock 

synchronization]. (H)

APPENDIX F - AU PAGE F-58 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-9 PROTECTION OF AUDIT INFORMATION 

Control: The information system protects audit information and audit tools from 

unauthorized access, modification, and deletion. 

Supplemental Guidance: Audit information includes all information (e.g., audit records, 

audit settings, and audit reports) needed to successfully audit information system activity. 

AU-9.1 ASSESSMENT OBJECTIVE:

Determine if the information system protects audit information and audit tools from 

unauthorized access, modification, and deletion. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing protection of audit 

information; access control policy and procedures; information system design 

documentation; information system configuration settings and associated documentation, 

information system audit records; audit tools; other relevant documents or records]. (L) (M)

(H)

Test: [SELECT FROM: Automated mechanisms implementing audit information protection]. (H)

APPENDIX F - AU PAGE F-59 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-9(1) PROTECTION OF AUDIT INFORMATION 

Control Enhancement: 

The information system produces audit records on hardware-enforced, write-once media. 

AU-9(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system produces audit information on hardware-enforced, 

write-once media. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing protection of audit 

information; access control policy and procedures; information system design 

documentation; information system hardware settings; information system configuration 

settings and associated documentation, information system audit records; other relevant 

documents or records]. 

Test: [SELECT FROM: Media storage devices].

APPENDIX F - AU PAGE F-60 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-10 NON-REPUDIATION 

Control: The information system provides the capability to determine whether a given 

individual took a particular action.

Supplemental Guidance: Examples of particular actions taken by individuals include 

creating information, sending a message, approving information (e.g., indicating 

concurrence or signing a contract), and receiving a message. Non-repudiation protects 

against later false claims by an individual of not having taken a specific action. Nonrepudiation protects individuals against later claims by an author of not having authored a 

particular document, a sender of not having transmitted a message, a receiver of not 

having received a message, or a signatory of not having signed a document. Nonrepudiation services can be used to determine if information originated from an 

individual, or if an individual took specific actions (e.g., sending an email, signing a 

contract, approving a procurement request) or received specific information. Nonrepudiation services are obtained by employing various techniques or mechanisms (e.g., 

digital signatures, digital message receipts, time stamps). 

AU-10.1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to determine whether a given 

individual took a particular action (e.g., created information, sent a message, approved 

information [e.g., to indicate concurrence or sign a contract] or received a message). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing non-repudiation; 

information system design documentation; information system configuration settings and 

associated documentation; information system audit records; other relevant documents or 

records]. 

Test: [SELECT FROM: Automated mechanisms implementing non-repudiation capability].

APPENDIX F - AU PAGE F-61 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - AU PAGE F-62 

FAMILY: AUDIT AND ACCOUNTABILITY CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

AU-11 AUDIT RECORD RETENTION 

Control: The organization retains audit records for [Assignment: organization-defined time 

period] to provide support for after-the-fact investigations of security incidents and to 

meet regulatory and organizational information retention requirements.

Supplemental Guidance: The organization retains audit records until it is determined that 

they are no longer needed for administrative, legal, audit, or other operational purposes. 

This includes, for example, retention and availability of audit records relative to Freedom 

of Information Act (FOIA) requests, subpoena, and law enforcement actions. Standard 

categorizations of audit records relative to such types of actions and standard response 

processes for each type of action are developed and disseminated. NIST Special 

Publication 800-61 provides guidance on computer security incident handling and audit 

record retention. 

AU-11.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the retention period for audit records generated by the 

information system; and 

(ii) the organization retains information system audit records for the organizationdefined time period to provide support for after-the-fact investigations of security 

incidents and to meet regulatory and organizational information retention 

requirements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit record 

retention; organization-defined retention period for audit records; information system audit 

records; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system audit record retention 

responsibilities]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-1 CERTIFICATION, ACCREDITATION, AND SECURITY ASSESSMENT POLICIES AND 

PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) 

formal, documented, security assessment and certification and accreditation policies that 

address purpose, scope, roles, responsibilities, management commitment, coordination 

among organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the security assessment and certification and accreditation 

policies and associated assessment, certification, and accreditation controls. 

Supplemental Guidance: The security assessment and certification and accreditation 

policies and procedures are consistent with applicable laws, Executive Orders, directives, 

policies, regulations, standards, and guidance. The security assessment and certification 

and accreditation policies can be included as part of the general information security 

policy for the organization. Security assessment and certification and accreditation 

procedures can be developed for the security program in general, and for a particular 

information system, when required. The organization defines what constitutes a 

significant change to the information system to achieve consistent security 

reaccreditations. NIST Special Publication 800-53A provides guidance on security 

control assessments. NIST Special Publication 800-37 provides guidance on security 

certification and accreditation. NIST Special Publication 800-12 provides guidance on 

security policies and procedures. 

CA-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents security assessment and certification and 

accreditation policies and procedures; 

(ii) the organization disseminates security assessment and certification and 

accreditation policies and procedures to appropriate elements within the 

organization; 

(iii) responsible parties within the organization periodically review policy and 

procedures; and 

(iv) the organization updates security assessment and certification and accreditation 

policies and procedures when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security assessment and certification and accreditation policies and 

procedures; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security assessment and certification and 

accreditation responsibilities]. (H)

APPENDIX F - CA PAGE F-63 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

CA-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the security assessment and certification and accreditation policies address 

purpose, scope, roles and responsibilities, management commitment, coordination 

among organizational entities, and compliance; 

(ii) the security assessment and certification and accreditation policies are consistent 

with the organization’s mission and functions and with applicable laws, directives, 

policies, regulations, standards, and guidance; and 

(iii) the security assessment and certification and accreditation procedures address all 

areas identified in the security assessment and certification and accreditation 

policies and address achieving policy-compliant implementations of all associated 

security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security assessment and certification and accreditation policies and 

procedures; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security assessment and certification and 

accreditation responsibilities]. (H)

APPENDIX F - CA PAGE F-64 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-2 SECURITY ASSESSMENTS 

Control: The organization conducts an assessment of the security controls in the 

information system [Assignment: organization-defined frequency, at least annually] to 

determine the extent to which the controls are implemented correctly, operating as 

intended, and producing the desired outcome with respect to meeting the security 

requirements for the system. 

Supplemental Guidance: This control is intended to support the FISMA requirement that the 

management, operational, and technical controls in each information system contained in 

the inventory of major information systems be assessed with a frequency depending on 

risk, but no less than annually. The FISMA requirement for (at least) annual security 

control assessments should not be interpreted by organizations as adding additional 

assessment requirements to those requirements already in place in the security 

certification and accreditation process. To satisfy the annual FISMA assessment 

requirement, organizations can draw upon the security control assessment results from 

any of the following sources, including but not limited to: (i) security certifications 

conducted as part of an information system accreditation or reaccreditation process (see 

CA-4); (ii) continuous monitoring activities (see CA-7); or (iii) testing and evaluation of 

the information system as part of the ongoing system development life cycle process 

(provided that the testing and evaluation results are current and relevant to the 

determination of security control effectiveness). Existing security assessment results are 

reused to the extent that they are still valid and are supplemented with additional 

assessments as needed. Reuse of assessment information is critical in achieving a broadbased, cost-effective, and fully integrated security program capable of producing the 

needed evidence to determine the actual security status of the information system. 

OMB does not require an annual assessment of all security controls employed in an 

organizational information system. In accordance with OMB policy, organizations must 

annually assess a subset of the security controls based on: (i) the FIPS 199 security 

categorization of the information system; (ii) the specific security controls selected and 

employed by the organization to protect the information system; and (iii) the level of 

assurance (or confidence) that the organization must have in determining the 

effectiveness of the security controls in the information system. It is expected that the 

organization will assess all of the security controls in the information system during the 

three-year accreditation cycle. The organization can use the current year’s assessment 

results obtained during security certification to meet the annual FISMA assessment 

requirement (see CA-4). NIST Special Publication 800-53A provides guidance on 

security control assessments to include reuse of existing assessment results. Related 

security controls: CA-4, CA-6, CA-7, SA-11. 

CA-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system is in the inventory of major information systems; and 

(ii) the organization conducts an assessment of the security controls in the information 

system at an organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security assessment policy; procedures addressing security assessments; 

information system security plan; security assessment plan; security assessment report; 

assessment evidence; other relevant documents or records]. (L) (M) (H)

APPENDIX F - CA PAGE F-65 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-3 INFORMATION SYSTEM CONNECTIONS 

Control: The organization authorizes all connections from the information system to other 

information systems outside of the accreditation boundary through the use of system 

connection agreements and monitors/controls the system connections on an ongoing 

basis. 

Supplemental Guidance: Since FIPS 199 security categorizations apply to individual 

information systems, the organization carefully considers the risks that may be introduced 

when systems are connected to other information systems with different security 

requirements and security controls, both within the organization and external to the 

organization. Risk considerations also include information systems sharing the same 

networks. NIST Special Publication 800-47 provides guidance on connecting 

information systems. Related security controls: SC-7, SA-9. 

CA-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies all connections to external information systems (i.e., 

information systems outside of the accreditation boundary); 

(ii) the organization authorizes all connections from the information system to external 

information systems through the use of system connection agreements; 

(iii) the organization monitors/controls the system interconnections on an ongoing basis; 

and 

(iv) information system connection agreements are consistent with NIST Special 

Publication 800-47. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing information system 

connections; NIST Special Publication 800-47; system and communications protection 

policy; personnel security policy; information system connection agreements; information 

system security plan; information system design documentation; information system 

configuration management and control documentation; security assessment report; plan of 

action and milestones; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with responsibility for developing, implementing, 

or approving information system connection agreements]. (H)

APPENDIX F - CA PAGE F-66 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-4 SECURITY CERTIFICATION 

Control: The organization conducts an assessment of the security controls in the 

information system to determine the extent to which the controls are implemented 

correctly, operating as intended, and producing the desired outcome with respect to 

meeting the security requirements for the system. 

Supplemental Guidance: A security certification is conducted by the organization in support 

of the OMB Circular A-130, Appendix III requirement for accrediting the information 

system. The security certification is a key factor in all security accreditation (i.e., 

authorization) decisions and is integrated into and spans the system development life 

cycle. The organization assesses all security controls in an information system during the 

initial security accreditation. Subsequent to the initial accreditation and in accordance 

with OMB policy, the organization assesses a subset of the controls annually during 

continuous monitoring (see CA-7). The organization can use the current year’s 

assessment results obtained during security certification to meet the annual FISMA 

assessment requirement (see CA-2). NIST Special Publication 800-53A provides 

guidance on security control assessments. NIST Special Publication 800-37 provides 

guidance on security certification and accreditation. Related security controls: CA-2, 

CA-6, SA-11. 

CA-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization conducts an assessment of the security controls in the information 

system to determine the extent to which the controls are implemented correctly, 

operating as intended, and producing the desired outcome with respect to meeting 

the security requirements for the system; and 

(ii) the organization employs a security certification process in accordance with OMB 

policy and NIST Special Publications 800-37 and 800-53A. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing security 

certification; information system security plan; security assessment plan; security 

assessment report; assessment evidence; plan of action and milestones; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security certification responsibilities]. (H)

APPENDIX F - CA PAGE F-67 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-4(1) SECURITY CERTIFICATION 

Control Enhancement: 

The organization employs an independent certification agent or certification team to conduct 

an assessment of the security controls in the information system. 

Enhancement Supplemental Guidance: An independent certification agent or certification 

team is any individual or group capable of conducting an impartial assessment of an 

organizational information system. Impartiality implies that the assessors are free from 

any perceived or actual conflicts of interest with respect to the developmental, 

operational, and/or management chain of command associated with the information 

system or to the determination of security control effectiveness. Independent security 

certification services can be obtained from other elements within the organization or can 

be contracted to a public or private sector entity outside of the organization. Contracted 

certification services are considered independent if the information system owner is not 

directly involved in the contracting process or cannot unduly influence the independence 

of the certification agent or certification team conducting the assessment of the security 

controls in the information system. The authorizing official decides on the required level 

of certifier independence based on the criticality and sensitivity of the information system 

and the ultimate risk to organizational operations and organizational assets, and to 

individuals. The authorizing official determines if the level of certifier independence is 

sufficient to provide confidence that the assessment results produced are sound and can 

be used to make a credible, risk-based decision. In special situations, for example when 

the organization that owns the information system is small or the organizational structure 

requires that the assessment of the security controls be accomplished by individuals that 

are in the developmental, operational, and/or management chain of the system owner or 

authorizing official, independence in the certification process can be achieved by ensuring 

the assessment results are carefully reviewed and analyzed by an independent team of 

experts to validate the completeness, consistency, and veracity of the results. The 

authorizing official should consult with the Office of the Inspector General, the senior 

agency information security officer, and the chief information officer to fully discuss the 

implications of any decisions on certifier independence in the types of special 

circumstances described above. 

CA-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs an independent certification agent or certification 

team to conduct an assessment of the security controls in the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing security 

certification; security accreditation package (including information system security plan, 

security assessment report, plan of action and milestones, authorization statement); other 

relevant documents or records]. (M) (H)

APPENDIX F - CA PAGE F-68 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-5 PLAN OF ACTION AND MILESTONES 

Control: The organization develops and updates [Assignment: organization-defined 

frequency], a plan of action and milestones for the information system that documents the 

organization’s planned, implemented, and evaluated remedial actions to correct 

deficiencies noted during the assessment of the security controls and to reduce or 

eliminate known vulnerabilities in the system. 

Supplemental Guidance: The plan of action and milestones is a key document in the 

security accreditation package developed for the authorizing official and is subject to 

federal reporting requirements established by OMB. The plan of action and milestones 

updates are based on the findings from security control assessments, security impact 

analyses, and continuous monitoring activities. OMB FISMA reporting guidance 

contains instructions regarding organizational plans of action and milestones. NIST 

Special Publication 800-37 provides guidance on the security certification and 

accreditation of information systems. NIST Special Publication 800-30 provides 

guidance on risk mitigation. 

CA-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and updates at the organization-defined frequency, a plan 

of action and milestones for the information system; and 

(ii) the plan of action and milestones documents the planned, implemented, and 

evaluated remedial actions by the organization to correct any deficiencies noted 

during the assessment of the security controls and to reduce or eliminate known 

vulnerabilities in the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing plan of action 

and milestones; information system security plan; security assessment plan; security 

assessment report; assessment evidence; plan of action and milestones; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with plan of action and milestones development 

and implementation responsibilities]. (H)

APPENDIX F - CA PAGE F-69 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-6 SECURITY ACCREDITATION 

Control: The organization authorizes (i.e., accredits) the information system for processing 

before operations and updates the authorization [Assignment: organization-defined 

frequency, at least every three years] or when there is a significant change to the system. 

A senior organizational official signs and approves the security accreditation. 

Supplemental Guidance: OMB Circular A-130, Appendix III, establishes policy for security 

accreditations of federal information systems. The organization assesses the security 

controls employed within the information system before and in support of the security 

accreditation. Security assessments conducted in support of security accreditations are 

called security certifications. The security accreditation of an information system is not a 

static process. Through the employment of a comprehensive continuous monitoring 

process (the fourth and final phase of the certification and accreditation process), the 

critical information contained in the accreditation package (i.e., the system security plan, 

the security assessment report, and the plan of action and milestones) is updated on an 

ongoing basis providing the authorizing official and the information system owner with 

an up-to-date status of the security state of the information system. To reduce the 

administrative burden of the three-year reaccreditation process, the authorizing official 

uses the results of the ongoing continuous monitoring process to the maximum extent 

possible as the basis for rendering a reaccreditation decision. NIST Special Publication 

800-37 provides guidance on the security certification and accreditation of information 

systems. Related security controls: CA-2, CA-4, CA-7. 

CA-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization authorizes (i.e., accredits) the information system for processing 

before operations and updates the authorization in accordance with organizationdefined frequency, at least every three years; 

(ii) a senior organizational official signs and approves the security accreditation; 

(iii) the security accreditation process employed by the organization is consistent with 

NIST Special Publications 800-37; and 

(iv) the organization updates the authorization when there is a significant change to the 

information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing security 

accreditation; NIST Special Publication 800-37; security accreditation package (including 

information system security plan; security assessment report; plan of action and 

milestones; authorization statement); other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security accreditation responsibilities]. (H)

APPENDIX F - CA PAGE F-70 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-7 CONTINUOUS MONITORING 

Control: The organization monitors the security controls in the information system on an 

ongoing basis. 

Supplemental Guidance: Continuous monitoring activities include configuration 

management and control of information system components, security impact analyses of 

changes to the system, ongoing assessment of security controls, and status reporting. The 

organization assesses all security controls in an information system during the initial 

security accreditation. Subsequent to the initial accreditation and in accordance with 

OMB policy, the organization assesses a subset of the controls annually during 

continuous monitoring. The selection of an appropriate subset of security controls is 

based on: (i) the FIPS 199 security categorization of the information system; (ii) the 

specific security controls selected and employed by the organization to protect the 

information system; and (iii) the level of assurance (or grounds for confidence) that the 

organization must have in determining the effectiveness of the security controls in the 

information system. The organization establishes the selection criteria and subsequently 

selects a subset of the security controls employed within the information system for 

assessment. The organization also establishes the schedule for control monitoring to 

ensure adequate coverage is achieved. Those security controls that are volatile or critical 

to protecting the information system are assessed at least annually. All other controls are 

assessed at least once during the information system’s three-year accreditation cycle. The 

organization can use the current year’s assessment results obtained during continuous 

monitoring to meet the annual FISMA assessment requirement (see CA-2). 

This control is closely related to and mutually supportive of the activities required in 

monitoring configuration changes to the information system. An effective continuous 

monitoring program results in ongoing updates to the information system security plan, 

the security assessment report, and the plan of action and milestones—the three principle 

documents in the security accreditation package. A rigorous and well executed 

continuous monitoring process significantly reduces the level of effort required for the 

reaccreditation of the information system. NIST Special Publication 800-37 provides 

guidance on the continuous monitoring process. NIST Special Publication 800-53A 

provides guidance on the assessment of security controls. Related security controls: CA2, CA-4, CA-5, CA-6, CM-4. 

CA-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization monitors the security controls in the information system on an 

ongoing basis; and 

(ii) the organization employs a security control monitoring process consistent with 

NIST Special Publications 800-37 and 800-53A. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing continuous 

monitoring of information system security controls; NIST Special Publications 800-37 and 

800-53A; information system security plan; security assessment report; plan of action and 

milestones; information system monitoring records; security impact analyses; status 

reports; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities]. (H)

APPENDIX F - CA PAGE F-71 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

CA-7.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization conducts security impact analyses on changes to the information 

system; 

(ii) the organization documents and reports changes to or deficiencies in the security 

controls employed in the information system; and 

(iii) the organization makes adjustments to the information system security plan and 

plan of action and milestones, as appropriate, based on the activities associated 

with continuous monitoring of the security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing continuous 

monitoring of information system security controls; information system security plan; 

security assessment report; plan of action and milestones; information system monitoring 

records; security impact analyses; status reports; other relevant documents or records]. (L)

(M) (H)

Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities]. (H)

APPENDIX F - CA PAGE F-72 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - CA PAGE F-73 

FAMILY: CERTIFICATION, ACCREDITATION, AND SECURITY CLASS: MANAGEMENT 

 ASSESSMENTS 

ASSESSMENT PROCEDURE

CA-7(1) CONTINUOUS MONITORING 

Control Enhancement: 

The organization employs an independent certification agent or certification team to monitor 

the security controls in the information system on an ongoing basis. 

Enhancement Supplemental Guidance: The organization can extend and maximize the value 

of the ongoing assessment of security controls during the continuous monitoring process 

by requiring an independent certification agent or team to assess all of the security 

controls during the information system’s three-year accreditation cycle. Related security 

controls: CA-2, CA-4, CA-5, CA-6, CM-4.

CA-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs an independent certification agent or certification 

team to monitor the security controls in the information system on an ongoing basis. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing continuous 

monitoring of information system security controls; information system security plan; 

security assessment report; plan of action and milestones; information system monitoring 

records; security impact analyses; status reports; other relevant documents or records]. 

Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities].
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, configuration management policy that addresses purpose, scope, 

roles, responsibilities, management commitment, coordination among organizational 

entities, and compliance; and (ii) formal, documented procedures to facilitate the 

implementation of the configuration management policy and associated configuration 

management controls. 

Supplemental Guidance: The configuration management policy and procedures are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The configuration management policy can be included as part 

of the general information security policy for the organization. Configuration 

management procedures can be developed for the security program in general, and for a 

particular information system, when required. NIST Special Publication 800-12 provides 

guidance on security policies and procedures. 

CM-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents configuration management policy and 

procedures; 

(ii) the organization disseminates configuration management policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review configuration 

management policy and procedures; and 

(iv) the organization updates configuration management policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with configuration management and control 

responsibilities]. (H) 

APPENDIX F - CM PAGE F-74 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

CM-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the configuration management policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the configuration management policy is consistent with the organization’s mission 

and functions and with applicable laws, directives, policies, regulations, standards, 

and guidance; and 

(iii) the configuration management procedures address all areas identified in the 

configuration management policy and address achieving policy-compliant 

implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with configuration management and control 

responsibilities]. (H)

APPENDIX F - CM PAGE F-75 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-2 BASELINE CONFIGURATION 

Control: The organization develops, documents, and maintains a current baseline 

configuration of the information system. 

Supplemental Guidance: This control establishes a baseline configuration for the 

information system. The baseline configuration provides information about a particular 

component’s makeup (e.g., the standard software load for a workstation or notebook 

computer including updated patch information) and the component’s logical placement 

within the information system architecture. The baseline configuration also provides the 

organization with a well-defined and documented specification to which the information 

system is built and deviations, if required, are documented in support of mission 

needs/objectives. The baseline configuration of the information system is consistent with 

the Federal Enterprise Architecture. Related security controls: CM-6, CM-8. 

CM-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops, documents, and maintains a baseline configuration of the 

information system; 

(ii) the baseline configuration shows relationships among information system 

components and is consistent with the Federal Enterprise Architecture; 

(iii) the baseline configuration provides the organization with a well-defined and 

documented specification to which the information system is built; and 

(iv) the organization documents deviations from the baseline configuration, in support 

of mission needs/objectives. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline 

configuration of the information system; Federal Enterprise Architecture documentation; 

information system design documentation; information system architecture and 

configuration documentation; other relevant documents or records]. (L) (M) (H)

APPENDIX F - CM PAGE F-76 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-2(1) BASELINE CONFIGURATION 

Control Enhancement: 

The organization updates the baseline configuration of the information system as an integral 

part of information system component installations. 

CM-2(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies the frequency of updates to the baseline configuration 

and instances that trigger configuration updates; and 

(ii) the organization updates the baseline configuration of the information system as an 

integral part of information system component installations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline 

configuration of the information system; information system architecture and configuration 

documentation; other relevant documents or records]. (M) (H)

CM-2(2) BASELINE CONFIGURATION 

Control Enhancement: 

The organization employs automated mechanisms to maintain an up-to-date, complete, 

accurate, and readily available baseline configuration of the information system. 

CM-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to maintain an up-to-date, 

complete, accurate, and readily available baseline configuration of the information 

system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline 

configuration of the information system; information system design documentation; 

information system architecture and configuration documentation; other relevant 

documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing baseline configuration maintenance]. (H)

APPENDIX F - CM PAGE F-77 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-3 CONFIGURATION CHANGE CONTROL 

Control: The organization authorizes, documents, and controls changes to the information 

system. 

Supplemental Guidance: The organization manages configuration changes to the 

information system using an organizationally approved process (e.g., a chartered 

Configuration Control Board). Configuration change control involves the systematic 

proposal, justification, implementation, test/evaluation, review, and disposition of 

changes to the information system, including upgrades and modifications. Configuration 

change control includes changes to the configuration settings for information technology 

products (e.g., operating systems, firewalls, routers). The organization includes 

emergency changes in the configuration change control process, including changes 

resulting from the remediation of flaws. The approvals to implement a change to the 

information system include successful results from the security analysis of the change. 

The organization audits activities associated with configuration changes to the 

information system. Related security controls: CM-4, CM-6, SI-2. 

CM-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization authorizes, documents, and controls changes to the information 

system; 

(ii) the organization manages configuration changes to the information system using an 

organizationally approved process; 

(iii) the organization includes emergency changes in the configuration change control 

process, including changes resulting from the remediation of flaws; and 

(iv) the organization audits activities associated with configuration changes to the 

information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing information 

system configuration change control; information system architecture and configuration 

documentation; change control records; information system audit records; other relevant 

documents or records]. (M) (H)

APPENDIX F - CM PAGE F-78 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-3(1) CONFIGURATION CHANGE CONTROL 

Control Enhancement: 

The organization employs automated mechanisms to: (i) document proposed changes to the 

information system; (ii) notify appropriate approval authorities; (iii) highlight approvals that 

have not been received in a timely manner; (iv) inhibit change until necessary approvals are 

received; and (v) document completed changes to the information system. 

CM-3(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs automated mechanisms to document proposed changes to 

the information system; 

(ii) the organization employs automated mechanisms to notify appropriate approval 

authorities; 

(iii) the organization employs automated mechanisms to highlight approvals that have 

not been received in a timely manner; 

(iv) the organization employs automated mechanisms to inhibit change until necessary 

approvals are received; and 

(v) the organization employs automated mechanisms to document completed changes 

to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing information 

system configuration change control; information system design documentation; 

information system architecture and configuration documentation; automated 

configuration control mechanisms; change control records; information system audit 

records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing configuration change control]. (H)

For Industrial Control Systems 

CM-3(ICS-1)

 

CONFIGURATION CHANGE CONTROL 

ICS Control Enhancements: 

The organization tests, validates, and documents changes (e.g., patches and updates) before 

implementing the changes on the operational ICS. 

ICS Enhancement Supplemental Guidance: The organization ensures that testing does not 

interfere with ICS functions. The individual/group conducting the tests fully 

understands the organizational information security policies and procedures, the ICS 

security policies and procedures, and the specific health, safety, and environmental risks 

associated with a particular facility and/or process. A production ICS may need to be 

taken off-line, or replicated to the extent feasible, before testing can be conducted. If an 

ICS must be taken off-line for testing, the tests are scheduled to occur during planned 

ICS outages whenever possible. In situations where the organization cannot, for 

operational reasons, conduct live testing of a production ICS, the organization employs 

compensating controls (e.g., providing a replicated system to conduct testing) in 

accordance with the general tailoring guidance. 

APPENDIX F - CM PAGE F-79 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

CM-3(ICS-1) .1 ASSESSMENT OBJECTIVE:

Determine if the organization tests, validates, and documents changes (e.g., patches and 

updates) before implementing the changes on the operational ICS. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing ICS 

configuration change control; ICS architecture and configuration documentation; change control 

records; ICS audit records; other relevant documents or records]. (M) (H)

APPENDIX F - CM PAGE F-80 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-4 MONITORING CONFIGURATION CHANGES 

Control: The organization monitors changes to the information system conducting security 

impact analyses to determine the effects of the changes. 

Supplemental Guidance: Prior to change implementation, and as part of the change 

approval process, the organization analyzes changes to the information system for 

potential security impacts. After the information system is changed (including upgrades 

and modifications), the organization checks the security features to verify that the features 

are still functioning properly. The organization audits activities associated with 

configuration changes to the information system. Monitoring configuration changes and 

conducting security impact analyses are important elements with regard to the ongoing 

assessment of security controls in the information system. Related security control: CA7. 

CM-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies the types of information system changes to be monitored; 

(ii) the organization monitors changes to the information system; and 

(iii) the organization conducts security impact analyses to assess the effects of the 

information system changes. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing the monitoring of 

configuration changes to the information system; information system architecture and 

configuration documentation; change control records; information system audit records; 

other relevant documents or records]. (M) (H)

APPENDIX F - CM PAGE F-81 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-5 ACCESS RESTRICTIONS FOR CHANGE 

Control: The organization: (i) approves individual access privileges and enforces physical 

and logical access restrictions associated with changes to the information system; and (ii) 

generates, retains, and reviews records reflecting all such changes. 

Supplemental Guidance: Planned or unplanned changes to the hardware, software, and/or 

firmware components of the information system can have significant effects on the 

overall security of the system. Accordingly, only qualified and authorized individuals 

obtain access to information system components for purposes of initiating changes, 

including upgrades, and modifications. 

CM-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization maintains a list of qualified and authorized personnel permitted to 

access the information system for the express purpose of initiating changes; 

(ii) the organization approves individual access privileges and enforces physical and 

logical access restrictions associated with changes to the information system; and 

(iii) the organization generates, retains, and reviews records reflecting all such changes 

to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing access 

restrictions for changes to the information system; information system architecture and 

configuration documentation; change control records; information system audit records; 

other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Change control process and associated restrictions for changes to the 

information system]. (H)

APPENDIX F - CM PAGE F-82 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-5(1) ACCESS RESTRICTIONS FOR CHANGE 

Control Enhancement: 

The organization employs automated mechanisms to enforce access restrictions and support 

auditing of the enforcement actions. 

CM-5(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to enforce access 

restrictions and support auditing of the enforcement actions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing access 

restrictions for changes to the information system; information system design 

documentation; information system architecture and configuration documentation; change 

control records; information system audit records; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing access restrictions for changes to the 

information system]. (H)

APPENDIX F - CM PAGE F-83 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-6 CONFIGURATION SETTINGS 

Control: The organization: (i) establishes mandatory configuration settings for information 

technology products employed within the information system; (ii) configures the security 

settings of information technology products to the most restrictive mode consistent with 

operational requirements; (iii) documents the configuration settings; and (iv) enforces the 

configuration settings in all components of the information system. 

Supplemental Guidance: Configuration settings are the configurable parameters of the 

information technology products that compose the information system. Organizations 

monitor and control changes to the configuration settings in accordance with 

organizational policies and procedures. OMB FISMA reporting instructions provide 

guidance on configuration requirements for federal information systems. NIST Special 

Publication 800-70 provides guidance on producing and using configuration settings for 

information technology products employed in organizational information systems. 

Related security controls: CM-2, CM-3, SI-4. 

CM-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes mandatory configuration settings for information 

technology products employed within the information system; 

(ii) the organization configures the security settings of information technology products 

to the most restrictive mode consistent with operational requirements; 

(iii) the organization documents the configuration settings; and 

(iv) the organization enforces the configuration settings in all components of the 

information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing configuration 

settings for the information system; information system configuration settings and 

associated documentation; NIST Special Publication 800-70; other relevant documents or 

records]. (L) (M) (H)

Test: [SELECT FROM: Information system configuration settings]. (M) (H)

APPENDIX F - CM PAGE F-84 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-6(1) CONFIGURATION SETTINGS 

Control Enhancement: 

The organization employs automated mechanisms to centrally manage, apply, and verify 

configuration settings. 

CM-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs automated mechanisms to centrally manage, 

apply, and verify configuration settings. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing configuration 

settings for the information system; information system design documentation; information 

system configuration settings and associated documentation; other relevant documents or 

records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing the centralized management, application, 

and verification of configuration settings]. (H)

APPENDIX F - CM PAGE F-85 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-7 LEAST FUNCTIONALITY 

Control: The organization configures the information system to provide only essential 

capabilities and specifically prohibits and/or restricts the use of the following functions, 

ports, protocols, and/or services: [Assignment: organization-defined list of prohibited 

and/or restricted functions, ports, protocols, and/or services]. 

Supplemental Guidance: Information systems are capable of providing a wide variety of 

functions and services. Some of the functions and services, provided by default, may not 

be necessary to support essential organizational operations (e.g., key missions, functions). 

Additionally, it is sometimes convenient to provide multiple services from a single 

component of an information system, but doing so increases risk over limiting the 

services provided by any one component. Where feasible, the organization limits 

component functionality to a single function per device (e.g., email server or web server, 

not both). The functions and services provided by information systems, or individual 

components of information systems, are carefully reviewed to determine which functions 

and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant 

Messaging, File Transfer Protocol, Hyper Text Transfer Protocol, file sharing). 

CM-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies prohibited or restricted functions, ports, protocols, and 

services for the information system; 

(ii) the organization configures the information system to provide only essential 

capabilities; and 

(iii) the organization configures the information system to specifically prohibit and/or 

restrict the use of organization-defined prohibited and/or restricted functions, ports, 

protocols, and/or services. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing least functionality 

in the information system; information system security plan; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Information system for disabling or restriction of functions, ports, protocols, and 

services]. (M) (H)

APPENDIX F - CM PAGE F-86 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-7(1) LEAST FUNCTIONALITY 

Control Enhancement: 

The organization reviews the information system [Assignment: organization-defined 

frequency], to identify and eliminate unnecessary functions, ports, protocols, and/or services. 

CM-7(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of the information system reviews to identify 

and eliminate unnecessary functions, ports, protocols, and services; and 

(ii) the organization reviews the information system to identify and eliminate 

unnecessary functions, ports, protocols, and/or services in accordance with the 

organizational defined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing least functionality 

in the information system; information system security plan; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (H)

APPENDIX F - CM PAGE F-87 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-8 INFORMATION SYSTEM COMPONENT INVENTORY 

Control: The organization develops, documents, and maintains a current inventory of the 

components of the information system and relevant ownership information. 

Supplemental Guidance: The organization determines the appropriate level of granularity 

for the information system components included in the inventory that are subject to 

management control (i.e., tracking, and reporting). The inventory of information system 

components includes any information determined to be necessary by the organization to 

achieve effective property accountability (e.g., manufacturer, model number, serial 

number, software license information, system/component owner). The component 

inventory is consistent with the accreditation boundary of the information system. 

Related security controls: CM-2, CM-6. 

CM-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops, documents, and maintains a current inventory of the 

components of the information system; and 

(ii) the inventory of information system components includes any information 

determined to be necessary by the organization to achieve effective property 

accountability. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing information 

system component inventory; information system inventory records; other relevant 

documents or records]. (L) (M) (H)

APPENDIX F - CM PAGE F-88 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - CM PAGE F-89 

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CM-8(1) INFORMATION SYSTEM COMPONENT INVENTORY 

Control Enhancement: 

The organization updates the inventory of information system components as an integral part 

of component installations. 

CM-8(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization updates the inventory of information system components as 

an integral part of component installations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing information 

system component inventory; information system inventory records; component installation 

records; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system installation and inventory 

responsibilities]. (H)

CM-8(2) INFORMATION SYSTEM COMPONENT INVENTORY 

Control Enhancement: 

The organization employs automated mechanisms to help maintain an up-to-date, complete, 

accurate, and readily available inventory of information system components.

CM-8(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to maintain an up-to-date, 

complete, accurate, and readily available inventory of information system components. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Configuration management policy; procedures addressing information 

system component inventory; information system design documentation; information 

system inventory records; component installation records; other relevant documents or 

records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing information system component inventory 

management]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-1 CONTINGENCY PLANNING POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, contingency planning policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the contingency planning policy and associated contingency planning controls. 

Supplemental Guidance: The contingency planning policy and procedures are consistent 

with applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The contingency planning policy can be included as part of the general 

information security policy for the organization. Contingency planning procedures can 

be developed for the security program in general, and for a particular information system, 

when required. NIST Special Publication 800-34 provides guidance on contingency 

planning. NIST Special Publication 800-12 provides guidance on security policies and 

procedures. 

CP-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents contingency planning policy and 

procedures; 

(ii) the organization disseminates contingency planning policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review contingency 

planning policy and procedures; and 

(iv) the organization updates contingency planning policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities]. (H)

CP-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency planning policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the contingency planning policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the contingency planning procedures address all areas identified in the contingency 

planning policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities]. (H)

APPENDIX F - CP PAGE F-90 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-2 CONTINGENCY PLAN 

Control: The organization develops and implements a contingency plan for the 

information system addressing contingency roles, responsibilities, assigned individuals 

with contact information, and activities associated with restoring the system after a 

disruption or failure. Designated officials within the organization review and approve the 

contingency plan and distribute copies of the plan to key contingency personnel. 

Supplemental Guidance: None. 

CP-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents a contingency plan for the information 

system; 

(ii) the contingency plan is consistent with NIST Special Publication 800-34; 

(iii) the contingency plan addresses contingency roles, responsibilities, assigned 

individuals with contact information, and activities associated with restoring the 

information system after a disruption or failure; 

(iv) the contingency plan is reviewed and approved by designated organizational 

officials; and 

(v) the organization disseminates the contingency plan to key contingency personnel. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations 

for the information system; NIST Special Publication 800-34; contingency plan; other 

relevant documents or records]. (L) (M) (H)

CP-2.2 ASSESSMENT OBJECTIVE:

Determine if key contingency personnel and the key operating elements within the 

organization understand the contingency plan and are ready to implement the plan.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities]. (M) (H)

APPENDIX F - CP PAGE F-91 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-2(1) CONTINGENCY PLAN 

Control Enhancement: 

The organization coordinates contingency plan development with organizational elements 

responsible for related plans. 

Enhancement Supplemental Guidance: Examples of related plans include Business 

Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business 

Recovery Plan, Incident Response Plan, and Emergency Action Plan. 

CP-2(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization coordinates the contingency plan with other related plans 

(e.g., Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, 

Business Recovery Plan, Incident Response Plan, Emergency Action Plan). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations 

for the information system; contingency plan; other related plans; other relevant documents 

or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities and responsibilities in related plan areas]. (M) (H)

CP-2(2) CONTINGENCY PLAN 

Control Enhancement: 

The organization conducts capacity planning so that necessary capacity for information 

processing, telecommunications, and environmental support exists during crisis situations.

CP-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization conducts capacity planning so that necessary capacity for 

information processing, telecommunications, and environmental support exists during 

crisis situations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; procedures addressing contingency operations 

for the information system; contingency plan; capacity planning documents; other relevant 

documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities]. (H)

APPENDIX F - CP PAGE F-92 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-3 CONTINGENCY TRAINING 

Control: The organization trains personnel in their contingency roles and responsibilities 

with respect to the information system and provides refresher training [Assignment: 

organization-defined frequency, at least annually]. 

Supplemental Guidance: None. 

CP-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization provides contingency training to personnel with significant 

contingency roles and responsibilities; 

(ii) the organization records the type of contingency training received and the date 

completed; 

(iii) the organization defines frequency of refresher contingency training; and 

(iv) the organization provides initial training and refresher training in accordance with 

organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency training; contingency training curriculum; contingency training material; 

information system security plan; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, 

and training responsibilities]. (M) (H)

CP-3.2 ASSESSMENT OBJECTIVE:

Determine if contingency training material addresses the procedures and activities 

necessary to fulfill identified organizational contingency roles and responsibilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency training; contingency training curriculum; contingency training material; other 

relevant documents or records]. (M) (H)

APPENDIX F - CP PAGE F-93 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-3(1) CONTINGENCY TRAINING 

Control Enhancement: 

The organization incorporates simulated events into contingency training to facilitate effective 

response by personnel in crisis situations. 

CP-3(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization incorporates simulated events into contingency training; and 

(ii) the training is effective in getting organizational personnel to respond as expected 

to simulated crisis situations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency training; contingency training curriculum; contingency training material; other 

relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, 

and training responsibilities]. (H)

CP-3(2) CONTINGENCY TRAINING 

Control Enhancement: 

The organization employs automated mechanisms to provide a more thorough and realistic 

training environment. 

CP-3(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs automated mechanisms for contingency training; and 

(ii) the automated mechanisms improve the effectiveness of the contingency training. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency training; automated mechanisms supporting contingency training; contingency 

training curriculum; contingency training material; other relevant documents or records]. 

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, 

and training responsibilities].

APPENDIX F - CP PAGE F-94 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-4 CONTINGENCY PLAN TESTING AND EXERCISES 

Control: The organization: (i) tests and/or exercises the contingency plan for the 

information system [Assignment: organization-defined frequency, at least annually] using 

[Assignment: organization-defined tests and/or exercises] to determine the plan’s 

effectiveness and the organization’s readiness to execute the plan; and (ii) reviews the 

contingency plan test/exercise results and initiates corrective actions. 

Supplemental Guidance: There are several methods for testing and/or exercising 

contingency plans to identify potential weaknesses (e.g., full-scale contingency plan 

testing, functional/tabletop exercises). The depth and rigor of contingency plan testing 

and/or exercises increases with the FIPS 199 impact level of the information system. 

Contingency plan testing and/or exercises also include a determination of the effects on 

organizational operations and assets (e.g., reduction in mission capability) and individuals 

arising due to contingency operations in accordance with the plan. NIST Special 

Publication 800-84 provides guidance on test, training, and exercise programs for 

information technology plans and capabilities. 

CP-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of contingency plan tests and/or exercises; 

(ii) the organization defines the set of contingency plan tests and/or exercises; 

(iii) the organization tests/exercises the contingency plan using organization-defined 

tests/exercises in accordance with organization-defined frequency; 

(iv) the organization documents the results of contingency plan testing/exercises; and 

(v) the organization reviews the contingency plan test/exercise results and takes 

corrective actions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan, procedures addressing 

contingency plan testing and exercises; information system security plan; contingency plan 

testing and/or exercise documentation; other relevant documents or records]. (L) (M) (H)

CP-4.2 ASSESSMENT OBJECTIVE:

Determine if the contingency plan tests/exercises address key aspects of the plan.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency plan testing and exercises; contingency plan testing and/or exercise 

documentation; contingency plan test results; other relevant documents or records]. (L) (M)

(H)

APPENDIX F - CP PAGE F-95 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-4(1) CONTINGENCY PLAN TESTING AND EXERCISES 

Control Enhancement:

The organization coordinates contingency plan testing and/or exercises with organizational 

elements responsible for related plans. 

Enhancement Supplemental Guidance: Examples of related plans include Business 

Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business 

Recovery Plan, Incident Response Plan, and Emergency Action Plan. 

CP-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization coordinates contingency plan testing and/or exercises with 

organizational elements responsible for related plans (e.g., Business Continuity Plan, 

Disaster Recovery Plan, Continuity of Operations Plan, Business Recovery Plan, Incident 

Response Plan, Emergency Action Plan).

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency plan testing and exercises; contingency plan testing and/or exercise 

documentation; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, 

and testing responsibilities]. (M) (H)

CP-4(2) CONTINGENCY PLAN TESTING AND EXERCISES 

Control Enhancement:

The organization tests/exercises the contingency plan at the alternate processing site to 

familiarize contingency personnel with the facility and available resources and to evaluate the 

site’s capabilities to support contingency operations. 

CP-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization conducts contingency plan testing at the alternate 

processing site to familiarize contingency personnel with the facility and its resources 

and to evaluate the site’s capabilities to support contingency operations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan, procedures addressing 

contingency plan testing and exercises; contingency plan testing and/or exercise 

documentation; contingency plan test results; other relevant documents or records]. (H)

APPENDIX F - CP PAGE F-96 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

 FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-4(3) CONTINGENCY PLAN TESTING AND EXERCISES 

Control Enhancement:

The organization employs automated mechanisms to more thoroughly and effectively 

test/exercise the contingency plan by providing more complete coverage of contingency 

issues, selecting more realistic test/exercise scenarios and environments, and more 

effectively stressing the information system and supported missions. 

CP-4(3).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs automated mechanisms for contingency plan 

testing/exercises; and 

(ii) the automated mechanisms improve the effectiveness of the contingency plan 

testing/exercises. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency plan testing and exercises; automated mechanisms supporting contingency 

plan testing/exercises; contingency plan testing and/or exercise documentation; other 

relevant documents or records]. 

APPENDIX F - CP PAGE F-97 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

 FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-5 CONTINGENCY PLAN UPDATE 

Control: The organization reviews the contingency plan for the information system 

[Assignment: organization-defined frequency, at least annually] and revises the plan to 

address system/organizational changes or problems encountered during plan 

implementation, execution, or testing. 

Supplemental Guidance: Organizational changes include changes in mission, functions, or 

business processes supported by the information system. The organization communicates 

changes to appropriate organizational elements responsible for related plans (e.g., 

Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, 

Business Recovery Plan, Incident Response Plan, Emergency Action Plan). 

CP-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of contingency plan reviews and updates; 

(ii) the organization updates the contingency plan in accordance with organizationdefined frequency, at least annually; and 

(iii) the revised plan addresses the system/organizational changes identified by the 

organization or any problems encountered by the organization during plan 

implementation, execution, and testing. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency plan reviews and updates; information system security plan; other relevant 

documents or records]. (L) (M) (H)

CP-5.2 ASSESSMENT OBJECTIVE:

Determine if the organization communicates necessary changes to the contingency plan 

to other organizational elements with related plans.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

contingency plan reviews and updates; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency plan update responsibilities; 

organizational personnel with mission-related and operational responsibilities]. (M) (H)

APPENDIX F - CP PAGE F-98 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-6 ALTERNATE STORAGE SITE 

Control: The organization identifies an alternate storage site and initiates necessary 

agreements to permit the storage of information system backup information. 

Supplemental Guidance: The frequency of information system backups and the transfer rate 

of backup information to the alternate storage site (if so designated) are consistent with 

the organization’s recovery time objectives and recovery point objectives. 

CP-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies an alternate storage site; and 

(ii) alternate storage site agreements are currently in place (if needed) to permit 

storage of information system backup information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate storage sites; alternate storage site agreements; other relevant documents or 

records]. (M) (H)

CP-6.2 ASSESSMENT OBJECTIVE:

Determine if the alternate storage site is available, accessible, and meets the 

requirements (including necessary equipment and supplies) to permit the storage of 

information system backup information consistent with the organization’s recovery time 

objectives and recovery point objectives. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate storage sites; alternate storage site; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with alternate storage site responsibilities]. (H)

APPENDIX F - CP PAGE F-99 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-6(1) ALTERNATE STORAGE SITE 

Control Enhancement:

The organization identifies an alternate storage site that is geographically separated from the 

primary storage site so as not to be susceptible to the same hazards. 

CP-6(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency plan identifies the primary storage site hazards; and 

(ii) the alternate storage site is sufficiently separated from the primary storage site so 

as not to be susceptible to the same hazards identified at the primary site. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate storage sites; alternate storage site; other relevant documents or records]. (M) (H)

CP-6(2) ALTERNATE STORAGE SITE 

Control Enhancement:

The organization configures the alternate storage site to facilitate timely and effective recovery 

operations. 

CP-6(2).1 ASSESSMENT OBJECTIVE:

Determine if the alternate storage site is configured to enable timely and effective 

recovery of system backup information (i.e., meeting recovery time and recovery point 

objectives) in accordance with the provisions of alternate storage site agreements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate storage sites; alternate storage site agreements; alternate storage site; other 

relevant documents or records]. (H)

APPENDIX F - CP PAGE F-100 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-6(3) ALTERNATE STORAGE SITE 

Control Enhancement:

The organization identifies potential accessibility problems to the alternate storage site in the 

event of an area-wide disruption or disaster and outlines explicit mitigation actions. 

CP-6(3).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency plan identifies potential accessibility problems to the alternate 

storage site in the event of an area-wide disruption or disaster; and 

(ii) the contingency plan defines explicit mitigation actions for potential accessibility 

problems. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate storage sites; alternate storage site; other relevant documents or records]. (M) (H)

APPENDIX F - CP PAGE F-101 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-7 ALTERNATE PROCESSING SITE 

Control: The organization identifies an alternate processing site and initiates necessary 

agreements to permit the resumption of information system operations for critical 

mission/business functions within [Assignment: organization-defined time period] when 

the primary processing capabilities are unavailable. 

Supplemental Guidance: Equipment and supplies required to resume operations within the 

organization-defined time period are either available at the alternate site or contracts are 

in place to support delivery to the site. Timeframes to resume information system 

operations are consistent with organization-established recovery time objectives. 

CP-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies an alternate processing site; 

(ii) the organization defines the time period within which processing must be resumed 

at the alternate processing site; and 

(iii) alternate processing site agreements are currently in place (if needed) to permit the 

resumption of information system operations for critical mission/business functions 

within organization-defined time period. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site agreements; information system 

security plan; other relevant documents or records]. (M) (H)

CP-7.2 ASSESSMENT OBJECTIVE:

Determine if the alternate processing site is available, accessible, and meets the 

requirements (including necessary equipment and supplies) for resuming information 

system operations for critical mission/business functions within organization-defined time 

period. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site; other relevant documents or records]. 

(M) (H)

Interview: [SELECT FROM: Organizational personnel with alternate processing site responsibilities]. (H)

APPENDIX F - CP PAGE F-102 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-7(1) ALTERNATE PROCESSING SITE 

Control Enhancement:

The organization identifies an alternate processing site that is geographically separated from 

the primary processing site so as not to be susceptible to the same hazards. 

CP-7(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency plan identifies the primary processing site hazards; and 

(ii) the alternate processing site is sufficiently separated from the primary processing 

site so as not to be susceptible to the same hazards identified at the primary site. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site; other relevant documents or records]. 

(M) (H)

CP-7(2) ALTERNATE PROCESSING SITE 

Control Enhancement:

The organization identifies potential accessibility problems to the alternate processing site in 

the event of an area-wide disruption or disaster and outlines explicit mitigation actions. 

CP-7(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency plan identifies potential accessibility problems to the alternate 

processing site in the event of an area-wide disruption or disaster; and 

(ii) the contingency plan defines explicit mitigation actions for potential accessibility 

problems. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site; other relevant documents or records]. 

(M) (H)

APPENDIX F - CP PAGE F-103 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-7(3) ALTERNATE PROCESSING SITE 

Control Enhancement:

The organization develops alternate processing site agreements that contain priority-ofservice provisions in accordance with the organization’s availability requirements. 

CP-7(3).1 ASSESSMENT OBJECTIVE:

Determine if alternate processing site agreements contain priority-of-service provisions 

in accordance with the organization’s availability requirements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site agreements; other relevant documents 

or records]. (M) (H)

CP-7(4) ALTERNATE PROCESSING SITE 

Control Enhancement:

The organization fully configures the alternate processing site so that it is ready to be used as 

the operational site supporting a minimum required operational capability. 

CP-7(4).1 ASSESSMENT OBJECTIVE:

Determine if alternate processing site agreements specify the requirements needed to 

support the minimum required operational capability of the organization. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site; alternate processing site agreements; 

other relevant documents or records]. (H)

CP-7(4).2 ASSESSMENT OBJECTIVE:

Determine if the alternate processing site is configured to support the minimum required 

operational capability of the organization and is ready to use as the operational site. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate processing sites; alternate processing site; alternate processing site agreements; 

other relevant documents or records]. (H)

Test: [SELECT FROM: Information system at the alternate processing site]. (H)

APPENDIX F - CP PAGE F-104 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-8 TELECOMMUNICATIONS SERVICES 

Control: The organization identifies primary and alternate telecommunications services to 

support the information system and initiates necessary agreements to permit the 

resumption of system operations for critical mission/business functions within 

[Assignment: organization-defined time period] when the primary telecommunications 

capabilities are unavailable. 

Supplemental Guidance: In the event that the primary and/or alternate telecommunications 

services are provided by a common carrier, the organization requests 

Telecommunications Service Priority (TSP) for all telecommunications services used for 

national security emergency preparedness (see http://tsp.ncs.gov for a full explanation of 

the TSP program). 

CP-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies primary and alternate telecommunications services to 

support the information system; 

(ii) the organization defines the time period within which resumption of information 

system operations must take place; and 

(iii) alternate telecommunications service agreements are in place to permit the 

resumption of telecommunications services for critical mission/business functions 

within the organization-defined time period when the primary telecommunications 

capabilities are unavailable. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; information system security plan; primary and 

alternate telecommunications service agreements; other relevant documents or records]. 

(M) (H)

CP-8.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) telecommunications services supporting the organization are used for national 

security emergency preparedness; and 

(ii) a common carrier provides telecommunications services. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; primary and alternate telecommunications service 

agreements; other relevant documents or records]. (M) (H)

APPENDIX F - CP PAGE F-105 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-8(1) TELECOMMUNICATIONS SERVICES 

Control Enhancement:

The organization develops primary and alternate telecommunications service agreements that 

contain priority-of-service provisions in accordance with the organization’s availability 

requirements. 

CP-8(1).1 ASSESSMENT OBJECTIVE:

Determine if primary and alternate telecommunications service agreements contain 

priority-of-service provisions in accordance with the availability requirements defined in 

the organization’s contingency plan. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; primary and alternate telecommunications service 

agreements; other relevant documents or records]. (M) (H)

CP-8(2) TELECOMMUNICATIONS SERVICES 

Control Enhancement:

The organization obtains alternate telecommunications services that do not share a single 

point of failure with primary telecommunications services. 

CP-8(2).1 ASSESSMENT OBJECTIVE:

Determine if primary and alternate telecommunications services share a single point of 

failure. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; primary and alternate telecommunications service 

agreements; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities; telecommunications service providers]. (M) (H)

APPENDIX F - CP PAGE F-106 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-8(3) TELECOMMUNICATIONS SERVICES 

Control Enhancement:

The organization obtains alternate telecommunications service providers that are sufficiently 

separated from primary service providers so as not to be susceptible to the same hazards. 

CP-8(3).1 ASSESSMENT OBJECTIVE:

Determine if the alternate telecommunications service provider’s site is sufficiently 

separated from the primary telecommunications service provider’s site so as not to be 

susceptible to the same hazards identified at the primary site. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; primary and alternate telecommunications service 

agreements; alternate telecommunications service provider’s site; primary 

telecommunications service provider’s site; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning and plan 

implementation responsibilities; telecommunications service providers]. (H)

CP-8(4) TELECOMMUNICATIONS SERVICES 

Control Enhancement:

The organization requires primary and alternate telecommunications service providers to have 

adequate contingency plans.

CP-8(4).1 ASSESSMENT OBJECTIVE:

Determine if the contingency plans for the primary and alternate telecommunications 

service providers are sufficient to meet the needs of the organization. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

alternate telecommunications services; primary and alternate telecommunications service 

agreements; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with contingency planning, plan implementation, 

and testing responsibilities; telecommunications service providers]. (H)

Test: [SELECT FROM: Operational capability by exercising priority-of-service provisions of alternate 

telecommunications service agreements]. (H)

APPENDIX F - CP PAGE F-107 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-9 INFORMATION SYSTEM BACKUP 

Control: The organization conducts backups of user-level and system-level information 

(including system state information) contained in the information system [Assignment: 

organization-defined frequency] and protects backup information at the storage location. 

Supplemental Guidance: The frequency of information system backups and the transfer rate 

of backup information to alternate storage sites (if so designated) are consistent with the 

organization’s recovery time objectives and recovery point objectives. While integrity 

and availability are the primary concerns for system backup information, protecting 

backup information from unauthorized disclosure is also an important consideration 

depending on the type of information residing on the backup media and the FIPS 199 

impact level. An organizational assessment of risk guides the use of encryption for 

backup information. The protection of system backup information while in transit is 

beyond the scope of this control. Related security controls: MP-4, MP-5. 

CP-9.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of information systems backups; 

(ii) the organization defines the user-level and system-level information (including 

system state information) that is required to be backed up; and 

(iii) the organization identifies the location(s) for storing backup information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; backup storage location(s); 

other relevant documents or records]. (L) (M) (H)

CP-9.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization backs up the required user-level and system-level information 

(including system state information) in accordance with the organization-defined 

frequency; 

(ii) the organization stores backup information in designated locations in accordance 

with information system backup procedures; and 

(iii) the organization protects backup information at the designated storage locations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; backup storage location(s); 

other relevant documents or records]. (L) (M) (H)

APPENDIX F - CP PAGE F-108 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-9(1) INFORMATION SYSTEM BACKUP 

Control Enhancement: 

The organization tests backup information [Assignment: organization-defined frequency] to 

verify media reliability and information integrity. 

CP-9(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of information system backup testing; 

(ii) the organization conducts information system backup testing within the 

organization-defined frequency; and 

(iii) testing results verify backup media reliability and information integrity. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; information system backup 

test results; backup storage location(s); other relevant documents or records]. (M) (H)

CP-9(2) INFORMATION SYSTEM BACKUP 

Control Enhancement: 

The organization selectively uses backup information in the restoration of information system 

functions as part of contingency plan testing. 

CP-9(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization uses selected backup information in the restoration of 

information system functions as part of contingency plan testing. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system backup test results; contingency plan test 

results; other relevant documents or records]. (H)

APPENDIX F - CP PAGE F-109 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-9(3) INFORMATION SYSTEM BACKUP 

Control Enhancement: 

The organization stores backup copies of the operating system and other critical information 

system software in a separate facility or in a fire-rated container that is not collocated with the 

operational software.

CP-9(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization stores backup copies of operating system and other critical 

information system software in a separate facility or in a fire-rated container that is not 

collocated with the operational software. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; backup storage location(s); other relevant documents or 

records]. (H)

CP-9(4) INFORMATION SYSTEM BACKUP 

Control Enhancement: 

The organization protects system backup information from unauthorized modification. 

Enhancement Supplemental Guidance: The organization employs appropriate mechanisms 

(e.g., digital signatures, cryptographic hashes) to protect the integrity of information 

system backups. Protecting the confidentiality of system backup information is beyond 

the scope of this control. Related security controls: MP-4, MP-5. 

CP-9(4).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs appropriate mechanisms to protect the integrity of 

information system backup information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system design documentation; backup storage 

location(s); information system configuration settings and associated documentation; other 

relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system backup responsibilities]. 

(M) (H)

APPENDIX F - CP PAGE F-110 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION 

Control: The organization employs mechanisms with supporting procedures to allow the 

information system to be recovered and reconstituted to a known secure state after a 

disruption or failure. 

Supplemental Guidance: Information system recovery and reconstitution to a known secure 

state means that all system parameters (either default or organization-established) are set 

to secure values, security-critical patches are reinstalled, security-related configuration 

settings are reestablished, system documentation and operating procedures are available, 

application and system software is reinstalled and configured with secure settings, 

information from the most recent, known secure backups is loaded, and the system is 

fully tested. 

CP-10.1 ASSESSMENT OBJECTIVE:

Determine if the organization identifies the means for capturing the information system’s 

operational state including appropriate system parameters, patches, configuration 

settings, and application/system software prior to system disruption or failure. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system recovery and reconstitution; information system configuration settings 

and associated documentation; information system design documentation; other relevant 

documents or records]. (L) (M) (H)

CP-10.2 ASSESSMENT OBJECTIVE:

Determine if the organization makes available and applies mechanisms and procedures 

for recovery and reconstitution of the information system to known secure state after 

disruption or failure. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system recovery and reconstitution; information system configuration settings 

and associated documentation; information system design documentation; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information system recovery and 

reconstitution operations]. (M) (H)

APPENDIX F - CP PAGE F-111 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - CP PAGE F-112 

FAMILY: CONTINGENCY PLANNING CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

CP-10(1) INFORMATION SYSTEM RECOVERY AND RECONSTITUTION 

Control Enhancement: 

The organization includes a full recovery and reconstitution of the information system as part 

of contingency plan testing. 

CP-10(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization includes a full recovery and reconstitution of the 

information system as part of contingency plan testing. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system recovery and reconstitution; contingency plan test procedures; 

contingency plan test results; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system recovery and 

reconstitution responsibilities; organizational personnel with contingency testing 

responsibilities]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-1 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES 

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, identification and authentication policy that addresses purpose, 

scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the identification and authentication policy and associated 

identification and authentication controls. 

Supplemental Guidance: The identification and authentication policy and procedures are 

consistent with: (i) FIPS 201 and Special Publications 800-73, 800-76, and 800-78; and 

(ii) other applicable laws, Executive Orders, directives, policies, regulations, standards, 

and guidance. The identification and authentication policy can be included as part of the 

general information security policy for the organization. Identification and authentication 

procedures can be developed for the security program in general, and for a particular 

information system, when required. NIST Special Publication 800-12 provides guidance 

on security policies and procedures. NIST Special Publication 800-63 provides guidance 

on remote electronic authentication. 

IA-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents identification and authentication policy 

and procedures; 

(ii) the organization disseminates identification and authentication policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review identification and 

authentication policy and procedures; and 

(iv) the organization updates identification and authentication policy and procedures 

when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with identification and authentication 

responsibilities]. (H)

APPENDIX F - IA PAGE F-113 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

IA-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the identification and authentication policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the identification and authentication policy is consistent with the organization’s 

mission and functions and with applicable laws, directives, policies, regulations, 

standards, and guidance; and 

(iii) the identification and authentication procedures address all areas identified in the 

identification and authentication policy and address achieving policy-compliant 

implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with identification and authentication 

responsibilities]. (H)

APPENDIX F - IA PAGE F-114 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-2 USER IDENTIFICATION AND AUTHENTICATION 

Control: The information system uniquely identifies and authenticates users (or processes 

acting on behalf of users). 

Supplemental Guidance: Users are uniquely identified and authenticated for all accesses 

other than those accesses explicitly identified and documented by the organization in 

accordance security control AC-14. Authentication of user identities is accomplished 

through the use of passwords, tokens, biometrics, or in the case of multifactor 

authentication, some combination thereof. NIST Special Publication 800-63 provides 

guidance on remote electronic authentication including strength of authentication 

mechanisms. For purposes of this control, the guidance provided in Special Publication 

800-63 is applied to both local and remote access to information systems. Remote access 

is any access to an organizational information system by a user (or an information 

system) communicating through an external, non-organization-controlled network (e.g., 

the Internet). Local access is any access to an organizational information system by a 

user (or an information system) communicating through an internal organizationcontrolled network (e.g., local area network) or directly to a device without the use of a 

network. Unless a more stringent control enhancement is specified, authentication for 

both local and remote information system access is NIST Special Publication 800-63 

level 1 compliant. FIPS 201 and Special Publications 800-73, 800-76, and 800-78 

specify a personal identity verification (PIV) credential for use in the unique 

identification and authentication of federal employees and contractors. In addition to 

identifying and authenticating users at the information system level (i.e., at system 

logon), identification and authentication mechanisms are employed at the application 

level, when necessary, to provide increased information security for the organization. 

In accordance with OMB policy and E-Authentication E-Government initiative, 

authentication of public users accessing federal information systems may also be required 

to protect nonpublic or privacy-related information. The e-authentication risk assessment 

conducted in accordance with OMB Memorandum 04-04 is used in determining the NIST 

Special Publication 800-63 compliance requirements for such accesses with regard to the 

IA-2 control and its enhancements. Scalability, practicality, and security issues are 

simultaneously considered in balancing the need to ensure ease of use for public access to 

such information and information systems with the need to protect organizational 

operations, organizational assets, and individuals. Related security controls: AC-14, AC17. 

APPENDIX F - IA PAGE F-115 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

IA-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system uniquely identifies and authenticates users (or processes 

acting on behalf of users); and 

(ii) authentication levels for users (or processes acting on behalf of users) are 

consistent NIST Special Publication 800-63 and e-authentication risk assessment 

results. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system design 

documentation; e-authentication risk assessment results; information system configuration 

settings and associated documentation; information system audit records; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing identification and authentication capability 

for the information system]. (M) (H) 

APPENDIX F - IA PAGE F-116 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-2(1) USER IDENTIFICATION AND AUTHENTICATION 

Control Enhancement:

The information system employs multifactor authentication for remote system access that is 

NIST Special Publication 800-63 [Selection: organization-defined level 3, level 3 using a 

hardware authentication device, or level 4] compliant. 

IA-2(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

(ii) the information system employs multifactor authentication for remote system access 

that is NIST Special Publication 800-63 compliant in accordance with the 

organizational selection of level 3, level 3 using a hardware authentication device, 

or level 4. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system security 

plan; information system design documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (M)

IA-2(2) USER IDENTIFICATION AND AUTHENTICATION 

Control Enhancement:

The information system employs multifactor authentication for local system access that is 

NIST Special Publication 800-63 [Selection: organization-defined level 3 or level 4] compliant. 

IA-2(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

(ii) the information system employs multifactor authentication for local system access 

that is NIST Special Publication 800-63 compliant in accordance with the 

organizational selection of level 3 or level 4. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system security 

plan; information system design documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (H)

APPENDIX F - IA PAGE F-117 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-2(3) USER IDENTIFICATION AND AUTHENTICATION 

Control Enhancement:

The information system employs multifactor authentication for remote system access that is 

NIST Special Publication 800-63 level 4 compliant. 

IA-2(3).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

(ii) the information system employs multifactor authentication for remote system access 

that is NIST Special Publication 800-63 level 4 compliant. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (H)

APPENDIX F - IA PAGE F-118 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION 

Control: The information system identifies and authenticates specific devices before 

establishing a connection. 

Supplemental Guidance: The information system typically uses either shared known 

information (e.g., Media Access Control (MAC) or Transmission Control 

Protocol/Internet Protocol (TCP/IP) addresses) or an organizational authentication 

solution (e.g., IEEE 802.1x and Extensible Authentication Protocol (EAP) or a Radius 

server with EAP-Transport Layer Security (TLS) authentication) to identify and 

authenticate devices on local and/or wide area networks. The required strength of the 

device authentication mechanism is determined by the FIPS 199 security categorization 

of the information system with higher impact levels requiring stronger authentication. 

IA-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines specific devices requiring identification and authentication 

before establishing connections to the information system; and 

(ii) the information system identifies and authenticates specific devices identified by the 

organization before establishing connections. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing device 

identification and authentication; information system design documentation; device 

connection reports; information system configuration settings and associated 

documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing device identification and authentication]. 

(H)

APPENDIX F - IA PAGE F-119 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-4 IDENTIFIER MANAGEMENT 

Control: The organization manages user identifiers by: (i) uniquely identifying each user; 

(ii) verifying the identity of each user; (iii) receiving authorization to issue a user 

identifier from an appropriate organization official; (iv) issuing the user identifier to the 

intended party; (v) disabling the user identifier after [Assignment: organization-defined 

time period] of inactivity; and (vi) archiving user identifiers. 

Supplemental Guidance: Identifier management is not applicable to shared information 

system accounts (e.g., guest and anonymous accounts). FIPS 201 and Special 

Publications 800-73, 800-76, and 800-78 specify a personal identity verification (PIV) 

credential for use in the unique identification and authentication of federal employees and 

contractors. 

IA-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization manages user identifiers by uniquely identifying each user; 

(ii) the organization manages user identifiers by verifying the identity of each user; 

(iii) the organization manages user identifiers by receiving authorization to issue a user 

identifier from an appropriate organization official; 

(iv) the organization manages user identifiers by issuing the identifier to the intended 

party; 

(v) the organization defines the time period of inactivity after which a user identifier is 

to be disabled; 

(vi) the organization manages user identifiers by disabling the identifier after the 

organization-defined time period of inactivity; and 

(vii) the organization manages user identifiers by archiving identifiers. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing identifier 

management; information system security plan; information system design documentation; 

information system configuration settings and associated documentation; list of information 

system accounts; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Identity verification capability for the information system and for organizational 

facilities]. (M) (H)

IA-4.2 ASSESSMENT OBJECTIVE:

Determine if the organization uses a Personal Identity Verification (PIV) card token to 

uniquely identify and authenticate federal employees and contractors in accordance with 

FIPS 201 and NIST Special Publications 800-73, 800-76, and 800-78. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing identifier 

management; information system design documentation; FIPS 201; NIST Special 

Publications 800-73, 800-76, 800-78; information system configuration settings and 

associated documentation; list of information system accounts; other relevant documents 

or records]. (L) (M) (H)

Test: [SELECT FROM: Identity verification capability for the information system and for organizational 

facilities]. (M) (H)

APPENDIX F - IA PAGE F-120 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-5 AUTHENTICATOR MANAGEMENT 

Control: The organization manages information system authenticators by: (i) defining 

initial authenticator content; (ii) establishing administrative procedures for initial 

authenticator distribution, for lost/compromised, or damaged authenticators, and for 

revoking authenticators; (iii) changing default authenticators upon information system 

installation; and (iv) changing/refreshing authenticators periodically. 

Supplemental Guidance: Information system authenticators include, for example, tokens, 

PKI certificates, biometrics, passwords, and key cards. Users take reasonable measures to 

safeguard authenticators including maintaining possession of their individual 

authenticators, not loaning or sharing authenticators with others, and reporting lost or 

compromised authenticators immediately. For password-based authentication, the 

information system: (i) protects passwords from unauthorized disclosure and modification 

when stored and transmitted; (ii) prohibits passwords from being displayed when entered; 

(iii) enforces password minimum and maximum lifetime restrictions; and (iv) prohibits 

password reuse for a specified number of generations. For PKI-based authentication, the 

information system: (i) validates certificates by constructing a certification path to an 

accepted trust anchor; (ii) establishes user control of the corresponding private key; and 

(iii) maps the authenticated identity to the user account. In accordance with OMB policy 

and related E-authentication initiatives, authentication of public users accessing federal 

information systems (and associated authenticator management) may also be required to 

protect nonpublic or privacy-related information. FIPS 201 and Special Publications 800-

73, 800-76, and 800-78 specify a personal identity verification (PIV) credential for use in 

the unique identification and authentication of federal employees and contractors. NIST 

Special Publication 800-63 provides guidance on remote electronic authentication. 

IA-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization manages information system authenticators by defining initial 

authenticator content; 

(ii) the organization manages information system authenticators by establishing 

administrative procedures for initial authenticator distribution, for 

lost/compromised, or damaged authenticators, and for revoking authenticators; 

(iii) the organization manages information system authenticators by changing default 

authenticators upon information system installation; and 

(iv) the organization manages information system authenticators by changing/refreshing 

authenticators periodically. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing authenticator 

management; information system design documentation; information system configuration 

settings and associated documentation; list of information system accounts; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing authenticator management functions]. (M)

(H)

APPENDIX F - IA PAGE F-121 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-6 AUTHENTICATOR FEEDBACK 

Control: The information system obscures feedback of authentication information during 

the authentication process to protect the information from possible exploitation/use by 

unauthorized individuals. 

Supplemental Guidance: The feedback from the information system does not provide 

information that would allow an unauthorized user to compromise the authentication 

mechanism. Displaying asterisks when a user types in a password is an example of 

obscuring feedback of authentication information. 

IA-6.1 ASSESSMENT OBJECTIVE:

Determine if the information system obscures feedback of authentication information 

during the authentication process to protect the information from possible 

exploitation/use by unauthorized individuals. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing authenticator 

feedback; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing authenticator feedback]. (M) (H)

APPENDIX F - IA PAGE F-122 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - IA PAGE F-123 

FAMILY: IDENTIFICATION AND AUTHENTICATION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATION 

Control: The information system employs authentication methods that meet the 

requirements of applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance for authentication to a cryptographic module.

Supplemental Guidance: The applicable federal standard for authentication to a 

cryptographic module is FIPS 140-2 (as amended). Validation certificates issued by the 

NIST Cryptographic Module Validation Program (including FIPS 140-1, FIPS 140-2, and 

future amendments) remain in effect, and the modules remain available for continued use 

and purchase until a validation certificate is specifically revoked. Additional information 

on the use of validated cryptography is available at http://csrc.nist.gov/cryptval. 

IA-7.1 ASSESSMENT OBJECTIVE:

Determine if the information system employs authentication methods that meet the 

requirements of applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance for authentication to a cryptographic module (for non-national 

security systems, the cryptographic requirements are defined by FIPS 140-2, as 

amended). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Identification and authentication policy; FIPS 140-2 (as amended); 

procedures addressing cryptographic module authentication; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing cryptographic module authentication]. (M)

(H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-1 INCIDENT RESPONSE POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, incident response policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the incident response policy and associated incident response controls. 

Supplemental Guidance: The incident response policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The incident response policy can be included as part of the general information 

security policy for the organization. Incident response procedures can be developed for 

the security program in general, and for a particular information system, when required. 

NIST Special Publication 800-12 provides guidance on security policies and procedures. 

NIST Special Publication 800-61 provides guidance on incident handling and reporting. 

NIST Special Publication 800-83 provides guidance on malware incident handling and 

prevention. 

IR-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents incident response policy and procedures; 

(ii) the organization disseminates incident response policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review incident response 

policy and procedures; and 

(iv) the organization updates incident response policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident response planning and plan 

implementation responsibilities]. (H)

IR-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the incident response policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the incident response policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the incident response procedures address all areas identified in the incident 

response policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident response planning and plan 

implementation responsibilities]. (H)

APPENDIX F - IR PAGE F-124 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-2 INCIDENT RESPONSE TRAINING 

Control: The organization trains personnel in their incident response roles and 

responsibilities with respect to the information system and provides refresher training 

[Assignment: organization-defined frequency, at least annually]. 

Supplemental Guidance: None. 

IR-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies and documents personnel with incident response roles 

and responsibilities; 

(ii) the organization provides incident response training to personnel with incident 

response roles and responsibilities; 

(iii) incident response training material addresses the procedures and activities 

necessary to fulfill identified organizational incident response roles and 

responsibilities; 

(iv) the organization defines the frequency of refresher incident response training; and 

(v) the organization provides refresher incident response training in accordance with 

organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response training; 

incident response training material; information system security plan; incident response 

training records; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident response training and operational 

responsibilities]. (M) (H)

APPENDIX F - IR PAGE F-125 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-2(1) INCIDENT RESPONSE TRAINING 

Control Enhancement:

The organization incorporates simulated events into incident response training to facilitate 

effective response by personnel in crisis situations. 

IR-2(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization incorporates simulated events into incident response 

training to facilitate effective response by personnel in crisis situations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response training; 

incident response training material; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with incident response training and operational 

responsibilities]. (H)

IR-2(2) INCIDENT RESPONSE TRAINING 

Control Enhancement:

The organization employs automated mechanisms to provide a more thorough and realistic 

training environment. 

IR-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated incident response training mechanisms 

to provide a more thorough and realistic training environment. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response training; 

incident response training material; automated mechanisms supporting incident response 

training; other relevant documents or records]. 

Interview: [SELECT FROM: Organizational personnel with incident response training and operational 

responsibilities]. 

Test: [SELECT FROM: Simulated incident response training events]. 

APPENDIX F - IR PAGE F-126 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-3 INCIDENT RESPONSE TESTING AND EXERCISES 

Control: The organization tests and/or exercises the incident response capability for the 

information system [Assignment: organization-defined frequency, at least annually] using 

[Assignment: organization-defined tests and/or exercises] to determine the incident 

response effectiveness and documents the results. 

Supplemental Guidance: NIST Special Publication 800-84 provides guidance on test, 

training, and exercise programs for information technology plans and capabilities. 

IR-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines incident response tests/exercises; 

(ii) the organization defines the frequency of incident response tests/exercises; 

(iii) the organization tests/exercises the incident response capability for the information 

system using organization-defined tests/exercises in accordance with organizationdefined frequency; and 

(iv) the organization documents the results of incident response tests/exercises. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response testing 

and exercises; information system security plan; incident response testing material; 

incident response test results; other relevant documents or records]. (M) (H)

APPENDIX F - IR PAGE F-127 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-3(1) INCIDENT RESPONSE TESTING AND EXERCISES 

Control Enhancement:

The organization employs automated mechanisms to more thoroughly and effectively 

test/exercise the incident response capability. 

Enhancement Supplemental Guidance: Automated mechanisms can provide the ability to 

more thoroughly and effectively test or exercise the capability by providing more 

complete coverage of incident response issues, selecting more realistic test/exercise 

scenarios and environments, and more effectively stressing the response capability.

IR-3(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs automated mechanisms to more thoroughly and 

effectively test/exercise the incident response capability for the information system; 

and 

(ii) the automated mechanisms supporting incident response testing provide more 

complete coverage of incident response issues, more realistic test/exercise 

scenarios, and a greater stress on the incident response capability. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response testing 

and exercises; information system security plan; incident response testing documentation; 

automated mechanisms supporting incident response tests/exercises; other relevant 

documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with incident response testing responsibilities]. (H)

APPENDIX F - IR PAGE F-128 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-4 INCIDENT HANDLING 

Control: The organization implements an incident handling capability for security 

incidents that includes preparation, detection and analysis, containment, eradication, and 

recovery. 

Supplemental Guidance: Incident-related information can be obtained from a variety of 

sources including, but not limited to, audit monitoring, network monitoring, physical 

access monitoring, and user/administrator reports. The organization incorporates the 

lessons learned from ongoing incident handling activities into the incident response 

procedures and implements the procedures accordingly. Related security controls: AU-6, 

PE-6. 

IR-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization implements an incident handling capability for security incidents 

that includes preparation, detection and analysis, containment, eradication, and 

recovery; and 

(ii) the incident handling capability is consistent with NIST Special Publication 800-61. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident handling; NIST 

Special Publication 800-61; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident handling responsibilities]. (M) (H)

Test: [SELECT FROM: Incident handling capability for the organization]. (H)

APPENDIX F - IR PAGE F-129 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-4(1) INCIDENT HANDLING 

Control Enhancement:

The organization employs automated mechanisms to support the incident handling process. 

IR-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to support the incident 

handling process. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident handling; 

automated mechanisms supporting incident handling; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident handling responsibilities]. (H)

APPENDIX F - IR PAGE F-130 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-5 INCIDENT MONITORING 

Control: The organization tracks and documents information system security incidents on 

an ongoing basis. 

Supplemental Guidance: None. 

IR-5.1 ASSESSMENT OBJECTIVE:

Determine if the organization tracks and documents information system security incidents 

on an ongoing basis. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident monitoring; 

incident response records and documentation; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident monitoring responsibilities]. (H)

Test: [SELECT FROM: Incident monitoring capability for the organization]. (H)

APPENDIX F - IR PAGE F-131 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-5(1) INCIDENT MONITORING 

Control Enhancement:

The organization employs automated mechanisms to assist in the tracking of security 

incidents and in the collection and analysis of incident information. 

IR-5(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to assist in the tracking of 

security incidents and in the collection and analysis of incident information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident monitoring; 

information system design documentation; information system configuration settings and 

associated documentation; automated mechanisms supporting incident monitoring; other 

relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with incident monitoring responsibilities]. (H)

APPENDIX F - IR PAGE F-132 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-6 INCIDENT REPORTING 

Control: The organization promptly reports incident information to appropriate authorities. 

Supplemental Guidance: The types of incident information reported, the content and 

timeliness of the reports, and the list of designated reporting authorities or organizations 

are consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. Organizational officials report cyber security incidents to the 

United States Computer Emergency Readiness Team (US-CERT) at http://www.uscert.gov within the specified timeframe designated in the US-CERT Concept of 

Operations for Federal Cyber Security Incident Handling. In addition to incident 

information, weaknesses and vulnerabilities in the information system are reported to 

appropriate organizational officials in a timely manner to prevent security incidents. 

NIST Special Publication 800-61 provides guidance on incident reporting. 

IR-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization promptly reports incident information to appropriate authorities; 

(ii) incident reporting is consistent with NIST Special Publication 800-61. 

(iii) the types of incident information reported, the content and timeliness of the reports, 

and the list of designated reporting is consistent with applicable laws, Executive 

Orders, directives, policies, regulations, standards, and guidance; and 

(iv) weaknesses and vulnerabilities in the information system are reported to 

appropriate organizational officials in a timely manner to prevent security 

incidents. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident reporting; NIST 

Special Publication 800-61; incident reporting records and documentation; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident reporting responsibilities]. (M) (H)

Test: [SELECT FROM: Incident reporting capability for the organization]. (H)

APPENDIX F - IR PAGE F-133 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-6(1) INCIDENT REPORTING 

Control Enhancement:

The organization employs automated mechanisms to assist in the reporting of security 

incidents. 

IR-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to assist in the reporting of 

security incidents. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident reporting; 

automated mechanisms supporting incident reporting; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident reporting responsibilities]. (H)

APPENDIX F - IR PAGE F-134 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-7 INCIDENT RESPONSE ASSISTANCE 

Control: The organization provides an incident response support resource that offers 

advice and assistance to users of the information system for the handling and reporting of 

security incidents. The support resource is an integral part of the organization’s incident 

response capability. 

Supplemental Guidance: Possible implementations of incident response support resources 

in an organization include a help desk or an assistance group and access to forensics 

services, when required. 

IR-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization provides an incident response support resource that offers advice 

and assistance to users of the information system for the handling and reporting of 

security incidents; and 

(ii) the incident response support resource is an integral part of the organization’s 

incident response capability. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response 

assistance; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident response assistance and support 

responsibilities]. (M) (H)

APPENDIX F - IR PAGE F-135 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - IR PAGE F-136 

FAMILY: INCIDENT RESPONSE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

IR-7(1) INCIDENT RESPONSE ASSISTANCE 

Control Enhancement:

The organization employs automated mechanisms to increase the availability of incident 

response-related information and support. 

IR-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to increase the availability 

of incident response-related information and support for incident response support. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Incident response policy; procedures addressing incident response 

assistance; automated mechanisms supporting incident response support and assistance; 

other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with incident response support and assistance 

responsibilities and organizational personnel that require incident response support and 

assistance]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-1 SYSTEM MAINTENANCE POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, information system maintenance policy that addresses purpose, 

scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the information system maintenance policy and 

associated system maintenance controls. 

Supplemental Guidance: The information system maintenance policy and procedures are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The information system maintenance policy can be included as 

part of the general information security policy for the organization. System maintenance 

procedures can be developed for the security program in general, and for a particular 

information system, when required. NIST Special Publication 800-12 provides guidance 

on security policies and procedures. 

MA-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents information system maintenance policy 

and procedures; 

(ii) the organization disseminates information system maintenance policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review information system 

maintenance policy and procedures; and 

(iv) the organization updates information system maintenance policy and procedures 

when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (H)

MA-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system maintenance policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the information system maintenance policy is consistent with the organization’s 

mission and functions and with applicable laws, directives, policies, regulations, 

standards, and guidance; and 

(iii) the information system maintenance procedures address all areas identified in the 

system maintenance policy and address achieving policy-compliant implementations 

of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (H)

APPENDIX F - MA PAGE F-137 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-2 CONTROLLED MAINTENANCE 

Control: The organization schedules, performs, documents, and reviews records of routine 

preventative and regular maintenance (including repairs) on the components of the 

information system in accordance with manufacturer or vendor specifications and/or 

organizational requirements. 

Supplemental Guidance: All maintenance activities to include routine, scheduled 

maintenance and repairs are controlled; whether performed on site or remotely and 

whether the equipment is serviced on site or removed to another location. Organizational 

officials approve the removal of the information system or information system 

components from the facility when repairs are necessary. If the information system or 

component of the system requires off-site repair, the organization removes all information 

from associated media using approved procedures. After maintenance is performed on 

the information system, the organization checks all potentially impacted security controls 

to verify that the controls are still functioning properly. 

MA-2.1 ASSESSMENT OBJECTIVE:

Determine if the organization schedules, performs, documents, and reviews records of 

routine preventative and regular maintenance (including repairs) on the components of 

the information system in accordance with manufacturer or vendor specifications and/or 

organizational requirements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing controlled 

maintenance for the information system; maintenance records; manufacturer/vendor 

maintenance specifications; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (M) (H)

APPENDIX F - MA PAGE F-138 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-2(1) CONTROLLED MAINTENANCE 

Control Enhancement: 

The organization maintains maintenance records for the information system that include: (i) 

the date and time of maintenance; (ii) name of the individual performing the maintenance; (iii) 

name of escort, if necessary; (iv) a description of the maintenance performed; and (v) a list of 

equipment removed or replaced (including identification numbers, if applicable). 

MA-2(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization maintains maintenance records for the information system 

that include: (i) the date and time of maintenance; (ii) name of the individual performing 

the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance 

performed; and (v) a list of equipment removed or replaced (including identification 

numbers, if applicable). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing controlled 

maintenance for the information system; maintenance records; other relevant documents or 

records]. (M) (H)

MA-2(2) CONTROLLED MAINTENANCE 

Control Enhancement: 

The organization employs automated mechanisms to schedule and conduct maintenance as 

required, and to create up-to-date, accurate, complete, and available records of all 

maintenance actions, both needed and completed. 

MA-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to schedule and conduct 

maintenance as required, and to create accurate, complete, and available records of all 

maintenance actions, both needed and completed. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing controlled 

maintenance for the information system; automated mechanisms supporting information 

system maintenance activities; information system configuration settings and associated 

documentation; maintenance records; other relevant documents or records]. (H)

APPENDIX F - MA PAGE F-139 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-3 MAINTENANCE TOOLS 

Control: The organization approves, controls, and monitors the use of information system 

maintenance tools and maintains the tools on an ongoing basis. 

Supplemental Guidance: The intent of this control is to address hardware and software 

brought into the information system specifically for diagnostic/repair actions (e.g., a 

hardware or software packet sniffer that is introduced for the purpose of a particular 

maintenance activity). Hardware and/or software components that may support 

information system maintenance, yet are a part of the system (e.g., the software 

implementing “ping,” “ls,” “ipconfig,” or the hardware and software implementing the 

monitoring port of an Ethernet switch) are not covered by this control. 

MA-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization approves, controls, and monitors the use of information system 

maintenance tools; and 

(ii) the organization maintains maintenance tools on an ongoing basis. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; information system maintenance 

tools and associated documentation; procedures addressing information system 

maintenance tools; maintenance records; other relevant documents or records]. (M) (H)

APPENDIX F - MA PAGE F-140 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-3(1) MAINTENANCE TOOLS 

Control Enhancement: 

The organization inspects all maintenance tools carried into a facility by maintenance 

personnel for obvious improper modifications. 

Enhancement Supplemental Guidance: Maintenance tools include, for example, diagnostic 

and test equipment used to conduct maintenance on the information system.

MA-3(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization inspects all maintenance tools (e.g., diagnostic and test 

equipment) carried into a facility by maintenance personnel for obvious improper 

modifications. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; information system maintenance 

tools and associated documentation; procedures addressing information system 

maintenance tools; maintenance records; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (H)

MA-3(2) MAINTENANCE TOOLS 

Control Enhancement: 

The organization checks all media containing diagnostic and test programs for malicious code 

before the media are used in the information system. 

MA-3(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization checks all media containing diagnostic test programs (e.g., 

software or firmware used for information system maintenance or diagnostics) for 

malicious code before the media are used in the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; information system maintenance 

tools and associated documentation; procedures addressing information system 

maintenance tools; information system media containing maintenance programs (including 

diagnostic and test programs); maintenance records; other relevant documents or records]. 

(H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (H)

APPENDIX F - MA PAGE F-141 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-3(3) MAINTENANCE TOOLS 

Control Enhancement: 

The organization checks all maintenance equipment with the capability of retaining 

information so that no organizational information is written on the equipment or the equipment 

is appropriately sanitized before release; if the equipment cannot be sanitized, the equipment 

remains within the facility or is destroyed, unless an appropriate organization official explicitly 

authorizes an exception. 

MA-3(3).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization either checks all maintenance equipment with the capability of 

retaining information so that no organizational information is written on the 

equipment or the equipment is appropriately sanitized before release; and 

(ii) the organization retains the maintenance equipment within the facility or destroys 

the equipment if the equipment cannot be sanitized, unless an appropriate 

organization official explicitly authorizes an exception. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; information system maintenance 

tools and associated documentation; procedures addressing information system 

maintenance tools; information system media containing maintenance programs (including 

diagnostic and test programs); maintenance records; other relevant documents or records]. 

(H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (H)

MA-3(4) MAINTENANCE TOOLS 

Control Enhancement: 

The organization employs automated mechanisms to restrict the use of maintenance tools to 

authorized personnel only. 

MA-3(4).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to restrict the use of 

maintenance tools to authorized personnel only. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; information system maintenance 

tools and associated documentation; procedures addressing information system 

maintenance tools; automated mechanisms supporting information system maintenance 

activities; information system design documentation; information system configuration 

settings and associated documentation; maintenance records; other relevant documents or 

records]. 

Test: [SELECT FROM: Automated mechanisms supporting information system maintenance activities]. 

APPENDIX F - MA PAGE F-142 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-4 REMOTE MAINTENANCE 

Control: The organization authorizes, monitors, and controls any remotely executed 

maintenance and diagnostic activities, if employed. 

Supplemental Guidance: Remote maintenance and diagnostic activities are conducted by 

individuals communicating through an external, non-organization-controlled network 

(e.g., the Internet). The use of remote maintenance and diagnostic tools is consistent with 

organizational policy and documented in the security plan for the information system. 

The organization maintains records for all remote maintenance and diagnostic activities. 

Other techniques and/or controls to consider for improving the security of remote 

maintenance include: (i) encryption and decryption of communications; (ii) strong 

identification and authentication techniques, such as Level 3 or 4 tokens as described in 

NIST Special Publication 800-63; and (iii) remote disconnect verification. When remote 

maintenance is completed, the organization (or information system in certain cases) 

terminates all sessions and remote connections invoked in the performance of that 

activity. If password-based authentication is used to accomplish remote maintenance, the 

organization changes the passwords following each remote maintenance service. NIST 

Special Publication 800-88 provides guidance on media sanitization. The National 

Security Agency provides a listing of approved media sanitization products at 

http://www.nsa.gov/ia/government/mdg.cfm. Related security controls: IA-2, MP-6. 

MA-4.1 ASSESSMENT OBJECTIVE:

Determine if the organization authorizes, monitors, and controls remotely executed 

maintenance and diagnostic activities, if employed. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing remote 

maintenance for the information system; information system design documentation; 

information system configuration settings and associated documentation; maintenance 

records; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (M) (H)

APPENDIX F - MA PAGE F-143 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-4(1) REMOTE MAINTENANCE 

Control Enhancement: 

The organization audits all remote maintenance and diagnostic sessions and appropriate 

organizational personnel review the maintenance records of the remote sessions. 

MA-4(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization audits all remote maintenance and diagnostic sessions; and 

(ii) designated organizational personnel review the maintenance records of remote 

sessions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing remote 

maintenance for the information system; maintenance records; audit records; other relevant 

documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (M) (H)

MA-4(2) REMOTE MAINTENANCE 

Control Enhancement: 

The organization addresses the installation and use of remote maintenance and diagnostic 

links in the security plan for the information system. 

MA-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization addresses the installation and use of remote maintenance 

and diagnostic links in the security plan for the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing remote 

maintenance for the information system; information system security plan; maintenance 

records; audit records; other relevant documents or records]. (M) (H)

APPENDIX F - MA PAGE F-144 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-4(3) REMOTE MAINTENANCE 

Control Enhancement: 

The organization does not allow remote maintenance or diagnostic services to be performed 

by a provider that does not implement for its own information system, a level of security at 

least as high as that implemented on the system being serviced, unless the component being 

serviced is removed from the information system and sanitized (with regard to organizational 

information) before the service begins and also sanitized (with regard to potentially malicious 

software) after the service is performed and before being reconnected to the information 

system. 

MA-4(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization does not allow remote diagnostic or maintenance services 

to be performed by a provider that does not implement for its own information system, a 

level of security at least as high as the level of security implemented on the information 

system being serviced, unless the component being serviced is removed from the 

information system and sanitized (with regard to organizational information) before the 

service begins and also sanitized (with regard to potentially malicious software) after the 

service is performed and before being reconnected to the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing remote 

maintenance for the information system; service provider contracts and/or service level 

agreements; maintenance records; audit records; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities; information system maintenance provider]. (H)

APPENDIX F - MA PAGE F-145 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-5 MAINTENANCE PERSONNEL 

Control: The organization allows only authorized personnel to perform maintenance on 

the information system. 

Supplemental Guidance: Maintenance personnel (whether performing maintenance locally 

or remotely) have appropriate access authorizations to the information system when 

maintenance activities allow access to organizational information or could result in a 

future compromise of confidentiality, integrity, or availability. When maintenance 

personnel do not have needed access authorizations, organizational personnel with 

appropriate access authorizations supervise maintenance personnel during the 

performance of maintenance activities on the information system. 

MA-5.1 ASSESSMENT OBJECTIVE:

Determine if the organization allows only authorized personnel to perform maintenance 

on the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing 

maintenance personnel; service provider contracts and/or service level agreements; list of 

authorized personnel; maintenance records; other relevant documents or records]. (L) (M)

(H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (M) (H)

APPENDIX F - MA PAGE F-146 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - MA PAGE F-147 

FAMILY: MAINTENANCE CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MA-6 TIMELY MAINTENANCE 

Control: The organization obtains maintenance support and spare parts for [Assignment: 

organization-defined list of key information system components] within [Assignment: 

organization-defined time period] of failure. 

Supplemental Guidance: None. 

MA-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines key information system components; 

(ii) the organization defines the time period within which support and spare parts must 

be obtained after a failure; and 

(iii) the organization obtains maintenance support and spare parts for the organizationdefined list of key information system components within the organization-defined 

time period of failure. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system maintenance policy; procedures addressing timely 

maintenance for the information system; service provider contracts and/or service level 

agreements; inventory and availability of spare parts; information system security plan; 

other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system maintenance 

responsibilities]. (M) (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

MP-1 MEDIA PROTECTION POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, media protection policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the media protection policy and associated media protection controls. 

Supplemental Guidance: The media protection policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The media protection policy can be included as part of the general information 

security policy for the organization. Media protection procedures can be developed for 

the security program in general, and for a particular information system, when required. 

NIST Special Publication 800-12 provides guidance on security policies and procedures. 

MP-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents media protection policy and procedures; 

(ii) the organization disseminates media protection policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review media protection 

policy and procedures; and 

(iv) the organization updates media protection policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Media protection policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system media protection 

responsibilities]. (H)

MP-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the media protection policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the media protection policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the media protection procedures address all areas identified in the media 

protection policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Media protection policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system media protection 

responsibilities]. (H)

APPENDIX F - MP PAGE F-148 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-2 MEDIA ACCESS 

Control: The organization restricts access to information system media to authorized 

individuals. 

Supplemental Guidance: Information system media includes both digital media (e.g., 

diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, compact 

disks, digital video disks) and non-digital media (e.g., paper, microfilm). This control 

also applies to portable and mobile computing and communications devices with 

information storage capability (e.g., notebook computers, personal digital assistants, 

cellular telephones). 

An organizational assessment of risk guides the selection of media and associated 

information contained on that media requiring restricted access. Organizations document 

in policy and procedures, the media requiring restricted access, individuals authorized to 

access the media, and the specific measures taken to restrict access. The rigor with which 

this control is applied is commensurate with the FIPS 199 security categorization of the 

information contained on the media. For example, fewer protection measures are needed 

for media containing information determined by the organization to be in the public 

domain, to be publicly releasable, or to have limited or no adverse impact on the 

organization or individuals if accessed by other than authorized personnel. In these 

situations, it is assumed that the physical access controls where the media resides provide 

adequate protection. 

MP-2.1 ASSESSMENT OBJECTIVE:

Determine if the organization restricts access to information system media to authorized 

users. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

access; access control policy and procedures; physical and environmental protection policy 

and procedures; media storage facilities; access control records; other relevant documents 

or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system media protection 

responsibilities]. (M) (H)

APPENDIX F - MP PAGE F-149 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-2(1) MEDIA ACCESS 

Control Enhancement: 

The organization employs automated mechanisms to restrict access to media storage areas 

and to audit access attempts and access granted. 

Enhancement Supplemental Guidance: This control enhancement is primarily applicable to 

designated media storage areas within an organization where a significant volume of 

media is stored and is not intended to apply to every location where some media is stored 

(e.g., in individual offices). 

MP-2(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs automated mechanisms to restrict access to media storage 

areas; and 

(ii) the organization employs automated mechanisms to audit access attempts and 

access granted. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

access; access control policy and procedures; physical and environmental protection policy 

and procedures; media storage facilities; access control devices; access control records; 

audit records; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access restrictions to media storage 

areas]. (H)

APPENDIX F - MP PAGE F-150 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-3 MEDIA LABELING 

Control: The organization: (i) affixes external labels to removable information system 

media and information system output indicating the distribution limitations, handling 

caveats and applicable security markings (if any) of the information; and (ii) exempts 

[Assignment: organization-defined list of media types or hardware components] from 

labeling so long as they remain within [Assignment: organization-defined protected 

environment]. 

Supplemental Guidance: An organizational assessment of risk guides the selection of media 

requiring labeling. Organizations document in policy and procedures, the media 

requiring labeling and the specific measures taken to afford such protection. The rigor 

with which this control is applied is commensurate with the FIPS 199 security 

categorization of the information contained on the media. For example, labeling is not 

required for media containing information determined by the organization to be in the 

public domain or to be publicly releasable. 

MP-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines its protected environment for media labeling requirements; 

(ii) the organization identifies media types and hardware components that are exempted 

from external labeling requirements; 

(iii) the organization exempts the organization-defined list of media types and hardware 

components from labeling so long as they remain within the organization-defined 

protected environment; and 

(iv) the organization affixes external labels to removable information storage media and 

information system output indicating the distribution limitations, handling caveats 

and applicable security markings (if any) of the information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

labeling; physical and environmental protection policy and procedures; information system 

security plan; removable storage media and information system output; other relevant 

documents or records]. (H)

APPENDIX F - MP PAGE F-151 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-4 MEDIA STORAGE 

Control: The organization physically controls and securely stores information system 

media within controlled areas. 

Supplemental Guidance: Information system media includes both digital media (e.g., 

diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, compact 

disks, digital video disks) and non-digital media (e.g., paper, microfilm). A controlled 

area is any area or space for which the organization has confidence that the physical and 

procedural protections provided are sufficient to meet the requirements established for 

protecting the information and/or information system. This control applies to portable 

and mobile computing and communications devices with information storage capability 

(e.g., notebook computers, personal digital assistants, cellular telephones). Telephone 

systems are also considered information systems and may have the capability to store 

information on internal media (e.g., on voicemail systems). Since telephone systems do 

not have, in most cases, the identification, authentication, and access control mechanisms 

typically employed in other information systems, organizational personnel exercise 

extreme caution in the types of information stored on telephone voicemail systems. 

An organizational assessment of risk guides the selection of media and associated 

information contained on that media requiring physical protection. Organizations 

document in policy and procedures, the media requiring physical protection and the 

specific measures taken to afford such protection. The rigor with which this control is 

applied is commensurate with the FIPS 199 security categorization of the information 

contained on the media. For example, fewer protection measures are needed for media 

containing information determined by the organization to be in the public domain, to be 

publicly releasable, or to have limited or no adverse impact on the organization or 

individuals if accessed by other than authorized personnel. In these situations, it is 

assumed that the physical access controls to the facility where the media resides provide 

adequate protection. The organization protects information system media identified by 

the organization until the media are destroyed or sanitized using approved equipment, 

techniques, and procedures. 

As part of a defense-in-depth protection strategy, the organization considers routinely 

encrypting information at rest on selected secondary storage devices. FIPS 199 security 

categorization guides the selection of appropriate candidates for secondary storage 

encryption. The organization implements effective cryptographic key management in 

support of secondary storage encryption and provides protections to maintain the 

availability of the information in the event of the loss of cryptographic keys by users. 

NIST Special Publications 800-56 and 800-57 provide guidance on cryptographic key 

establishment and cryptographic key management. Related security controls: CP-9, RA2. 

APPENDIX F - MP PAGE F-152 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

MP-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines controlled areas for information system media; 

(ii) the organization selects and documents the media and associated information 

contained on that media requiring physical protection in accordance with an 

organizational assessment of risk; 

(iii) the organization defines the specific measures used to protect the selected media 

and information contained on that media; 

(iv) the organization physically controls and securely stores information system media 

within controlled areas; and 

(v) the organization protects information system media commensurate with the FIPS 

199 security categorization of the information contained on the media. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

storage; physical and environmental protection policy and procedures; access control 

policy and procedures; information system security plan; information system media; other 

relevant documents or records]. (M) (H)

APPENDIX F - MP PAGE F-153 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-5 MEDIA TRANSPORT 

Control: The organization protects and controls information system media during transport 

outside of controlled areas and restricts the activities associated with transport of such 

media to authorized personnel. 

Supplemental Guidance: Information system media includes both digital media (e.g., 

diskettes, tapes, removable hard drives, flash/thumb drives, compact disks, digital video 

disks) and non-digital media (e.g., paper, microfilm). A controlled area is any area or 

space for which the organization has confidence that the physical and procedural 

protections provided are sufficient to meet the requirements established for protecting the 

information and/or information system. This control also applies to portable and mobile 

computing and communications devices with information storage capability (e.g., 

notebook computers, personal digital assistants, cellular telephones) that are transported 

outside of controlled areas. Telephone systems are also considered information systems 

and may have the capability to store information on internal media (e.g., on voicemail 

systems). Since telephone systems do not have, in most cases, the identification, 

authentication, and access control mechanisms typically employed in other information 

systems, organizational personnel exercise extreme caution in the types of information 

stored on telephone voicemail systems that are transported outside of controlled areas. 

An organizational assessment of risk guides the selection of media and associated 

information contained on that media requiring protection during transport. Organizations 

document in policy and procedures, the media requiring protection during transport and 

the specific measures taken to protect such transported media. The rigor with which this 

control is applied is commensurate with the FIPS 199 security categorization of the 

information contained on the media. An organizational assessment of risk also guides the 

selection and use of appropriate storage containers for transporting non-digital media. 

Authorized transport and courier personnel may include individuals from outside the 

organization (e.g., U.S. Postal Service or a commercial transport or delivery service). 

MP-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies personnel authorized to transport information system 

media outside of controlled areas; 

(ii) the organization controls information system media during transport outside of 

controlled areas; and 

(iii) the organization restricts the activities associated with transport of information 

system media to authorized personnel. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

transport; physical and environmental protection policy and procedures; access control 

policy and procedures; information system security plan; list of organization-defined 

personnel authorized to transport information system media outside of controlled areas; 

information system media; information system media transport records; information system 

audit records; other relevant documents or records]. (M) (H)

APPENDIX F - MP PAGE F-154 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-5(1) MEDIA TRANSPORT 

Control Enhancement:

The organization protects digital and non-digital media during transport outside of controlled 

areas using [Assignment: organization-defined security measures, e.g., locked container, 

cryptography]. 

Enhancement Supplemental Guidance: Physical and technical security measures for the 

protection of digital and non-digital media are approved by the organization, 

commensurate with the FIPS 199 security categorization of the information residing on 

the media, and consistent with applicable laws, Executive Orders, directives, policies, 

regulations, standards, and guidance. Cryptographic mechanisms can provide 

confidentiality and/or integrity protections depending upon the mechanisms used. 

MP-5(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines security measures (e.g., locked container, cryptography) 

for information system media transported outside of controlled areas; 

(ii) the organization protects digital and non-digital media during transport outside of 

controlled areas using the organization-defined security measures. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

transport; physical and environmental protection policy and procedures; access control 

policy and procedures; information system security plan; information system media 

transport records; audit records; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system media transport 

responsibilities]. (H)

APPENDIX F - MP PAGE F-155 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-5(2) MEDIA TRANSPORT 

Control Enhancement:

The organization documents, where appropriate, activities associated with the transport of 

information system media using [Assignment: organization-defined system of records]. 

Enhancement Supplemental Guidance: Organizations establish documentation requirements 

for activities associated with the transport of information system media in accordance 

with the organizational assessment of risk. 

MP-5(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines a system of records for documenting activities associated 

with the transport of information system media; and 

(ii) the organization documents, where appropriate, activities associated with the 

transport of information system media using the organization-defined system of 

records. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

transport; physical and environmental protection policy and procedures; access control 

policy and procedures; information system security plan; information system media 

transport records; audit records; other relevant documents or records]. (M) (H)

APPENDIX F - MP PAGE F-156 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-5(3) MEDIA TRANSPORT 

Control Enhancement:

The organization employs an identified custodian at all times to transport information system 

media. 

Enhancement Supplemental Guidance: Organizations establish documentation requirements 

for activities associated with the transport of information system media in accordance 

with the organizational assessment of risk. 

MP-5(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs an identified custodian at all times to transport 

information system media. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

transport; physical and environmental protection policy and procedures; information system 

media transport records; audit records; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system media transport 

responsibilities]. (H)

APPENDIX F - MP PAGE F-157 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-6 MEDIA SANITIZATION AND DISPOSAL 

Control: The organization sanitizes information system media, both digital and nondigital, prior to disposal or release for reuse. 

Supplemental Guidance: Sanitization is the process used to remove information from 

information system media such that there is reasonable assurance, in proportion to the 

confidentiality of the information, that the information cannot be retrieved or 

reconstructed. Sanitization techniques, including clearing, purging, and destroying media 

information, prevent the disclosure of organizational information to unauthorized 

individuals when such media is reused or disposed. The organization uses its discretion 

on sanitization techniques and procedures for media containing information deemed to be 

in the public domain or publicly releasable, or deemed to have no adverse impact on the 

organization or individuals if released for reuse or disposed. NIST Special Publication 

800-88 provides guidance on media sanitization. The National Security Agency also 

provides media sanitization guidance and maintains a listing of approved sanitization 

products at http://www.nsa.gov/ia/government/mdg.cfm. 

MP-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies information system media requiring sanitization and the 

appropriate sanitization techniques and procedures to be used in the process; 

(ii) the organization sanitizes identified information system media, both paper and 

digital, prior to disposal or release for reuse; and 

(iii) information system media sanitation is consistent with NIST Special Publication 

800-88. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

sanitization and disposal; NIST Special Publication 800-88; media sanitization records; 

audit records; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system media sanitization 

responsibilities]. (M) (H)

APPENDIX F - MP PAGE F-158 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - MP PAGE F-159 

FAMILY: MEDIA PROTECTION CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

MP-6(1) MEDIA SANITIZATION AND DISPOSAL 

Control Enhancement:

The organization tracks, documents, and verifies media sanitization and disposal actions. 

MP-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization tracks, documents, and verifies media sanitization and 

disposal actions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy and procedures; media 

sanitization records; audit records; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system media sanitization 

responsibilities]. (H)

MP-6(2) MEDIA SANITIZATION AND DISPOSAL 

Control Enhancement:

The organization periodically tests sanitization equipment and procedures to verify correct 

performance. 

MP-6(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization periodically tests sanitization equipment and procedures to 

verify correct performance. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Information system media protection policy; procedures addressing media 

sanitization and disposal; media sanitization equipment test records; information system 

audit records; other relevant documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system media sanitization 

responsibilities]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-1 PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, physical and environmental protection policy that addresses 

purpose, scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the physical and environmental protection policy and 

associated physical and environmental protection controls. 

Supplemental Guidance: The physical and environmental protection policy and procedures 

are consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The physical and environmental protection policy can be 

included as part of the general information security policy for the organization. Physical 

and environmental protection procedures can be developed for the security program in 

general, and for a particular information system, when required. NIST Special 

Publication 800-12 provides guidance on security policies and procedures. 

PE-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents physical and environmental protection 

policy and procedures; 

(ii) the organization disseminates physical and environmental protection policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review physical and 

environmental protection policy and procedures; and 

(iv) the organization updates physical and environmental protection policy and 

procedures when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with physical and environmental protection 

responsibilities]. (H)

PE-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the physical and environmental protection policy addresses purpose, scope, roles 

and responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the physical and environmental protection policy is consistent with the 

organization’s mission and functions and with applicable laws, directives, policies, 

regulations, standards, and guidance; and 

(iii) the physical and environmental protection procedures address all areas identified in 

the physical and environmental protection policy and address achieving policycompliant implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with physical and environmental protection 

responsibilities]. (H)

APPENDIX F - PE PAGE F-160 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-2 PHYSICAL ACCESS AUTHORIZATIONS 

Control: The organization develops and keeps current a list of personnel with authorized 

access to the facility where the information system resides (except for those areas within 

the facility officially designated as publicly accessible) and issues appropriate 

authorization credentials. Designated officials within the organization review and 

approve the access list and authorization credentials [Assignment: organization-defined 

frequency, at least annually]. 

Supplemental Guidance: Appropriate authorization credentials include, for example, 

badges, identification cards, and smart cards. The organization promptly removes from 

the access list personnel no longer requiring access to the facility where the information 

system resides. 

PE-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies areas within the facility that are publicly accessible; 

(ii) the organization defines the frequency of review and approval for the physical 

access list and authorization credentials for the facility; 

(iii) the organization develops and keeps current lists of personnel with authorized 

access to the facility where the information system resides (except for those areas 

within the facility officially designated as publicly accessible); 

(iv) the organization issues appropriate authorization credentials (e.g., badges, 

identification cards, smart cards); and 

(v) designated officials within the organization review and approve the access list and 

authorization credentials at the organization-defined frequency, at least annually. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access authorizations; authorized personnel access list; authorization credentials; 

other relevant documents or records]. (L) (M) (H)

APPENDIX F - PE PAGE F-161 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-3 PHYSICAL ACCESS CONTROL 

Control: The organization controls all physical access points (including designated 

entry/exit points) to the facility where the information system resides (except for those 

areas within the facility officially designated as publicly accessible) and verifies 

individual access authorizations before granting access to the facility. The organization 

controls access to areas officially designated as publicly accessible, as appropriate, in 

accordance with the organization’s assessment of risk. 

Supplemental Guidance: The organization uses physical access devices (e.g., keys, locks, 

combinations, card readers) and/or guards to control entry to facilities containing 

information systems. The organization secures keys, combinations, and other access 

devices and inventories those devices regularly. The organization changes combinations 

and keys: (i) periodically; and (ii) when keys are lost, combinations are compromised, or 

individuals are transferred or terminated. Workstations and associated peripherals 

connected to (and part of) an organizational information system may be located in areas 

designated as publicly accessible with access to such devices being appropriately 

controlled. Where federal Personal Identity Verification (PIV) credential is used as an 

identification token and token-based access control is employed, the access control 

system conforms to the requirements of FIPS 201 and NIST Special Publication 800-73. 

If the token-based access control function employs cryptographic verification, the access 

control system conforms to the requirements of NIST Special Publication 800-78. If the 

token-based access control function employs biometric verification, the access control 

system conforms to the requirements of NIST Special Publication 800-76. 

PE-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization controls all physical access points (including designated entry/exit 

points) to the facility where the information system resides (except for those areas 

within the facility officially designated as publicly accessible); 

(ii) the organization verifies individual access authorizations before granting access to 

the facility; and 

(iii) the organization also controls access to areas officially designated as publicly 

accessible, as appropriate, in accordance with the organization’s assessment of 

risk. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access control; physical access control logs or records; other relevant documents 

or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with physical access control responsibilities]. (H)

Test: [SELECT FROM: Physical access control capability]. (M) (H)

APPENDIX F - PE PAGE F-162 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

PE-3.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) physical access devices (e.g., keys, locks, card readers) used at the facility are 

functioning properly and maintenance on these devices occurs on a regular and 

scheduled basis; 

(ii) the organization secures keys, combinations and other access devices on a regular 

basis; and 

(iii) keys and combinations to locks within the facility are periodically changed or when 

keys are lost, combinations are compromised, or individuals are transferred or 

terminated. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access control; physical access control logs or records; maintenance records; 

records of key and lock combination changes; storage locations for keys and access 

devices; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Physical access control devices]. (M) (H)

PE-3.3 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the access control system is consistent with FIPS 201 and NIST Special Publication 

800-73 (where the federal Personal Identity Verification (PIV) credential is used as 

an identification token and token-based access control is employed); 

(ii) the access control system is consistent with NIST Special Publication 800-78 

(where the token-based access control function employs cryptographic verification);

and 

(iii) the access control system is consistent with NIST Special Publication 800-76 

(where the token-based access control function employs biometric verification). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access control; FIPS 201; NIST Special Publications 800-73, 800-76, and 800-78; 

information system design documentation; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Physical access control devices]. (M) (H)

APPENDIX F - PE PAGE F-163 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-3(1) PHYSICAL ACCESS CONTROL 

Control Enhancement:

The organization controls physical access to the information system independent of the 

physical access controls for the facility. 

Enhancement Supplemental Guidance: This control enhancement, in general, applies to 

server rooms, communications centers, or any other areas within a facility containing 

large concentrations of information system components or components with a higher 

impact level than that of the majority of the facility. The intent is to provide an additional 

layer of physical security for those areas where the organization may be more vulnerable 

due to the concentration of information system components or the impact level of the 

components. The control enhancement is not intended to apply to workstations or 

peripheral devices that are typically dispersed throughout the facility and used routinely 

by organizational personnel. 

PE-3(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies specific areas within the facility containing large 

concentrations of information system components or components requiring 

additional physical protection; and 

(ii) for an information system identified as requiring additional physical protection or 

part of a large concentration of information system components, the organization 

controls physical access to the system independent of the physical access controls 

for the facility. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access control; physical access control logs or records; information system entry 

and exit points; list of areas within the facility containing high concentrations of information 

system components or information system components requiring additional physical 

protection; other relevant documents or records]. (H)

APPENDIX F - PE PAGE F-164 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-4 ACCESS CONTROL FOR TRANSMISSION MEDIUM 

Control: The organization controls physical access to information system distribution and 

transmission lines within organizational facilities. 

Supplemental Guidance: Physical protections applied to information system distribution 

and transmission lines help prevent accidental damage, disruption, and physical 

tampering. Additionally, physical protections are necessary to help prevent 

eavesdropping or in transit modification of unencrypted transmissions. Protective 

measures to control physical access to information system distribution and transmission 

lines include: (i) locked wiring closets; (ii) disconnected or locked spare jacks; and/or (iii) 

protection of cabling by conduit or cable trays. 

PE-4.1 ASSESSMENT OBJECTIVE:

Determine if the organization controls physical access to information system distribution 

and transmission lines within organizational facilities. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

access control for transmission medium; information system design documentation; facility 

communications and wiring diagrams; other relevant documents or records]. (H)

APPENDIX F - PE PAGE F-165 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-5 ACCESS CONTROL FOR DISPLAY MEDIUM 

Control: The organization controls physical access to information system devices that 

display information to prevent unauthorized individuals from observing the display 

output. 

Supplemental Guidance: None. 

PE-5.1 ASSESSMENT OBJECTIVE:

Determine if the organization controls physical access to information system devices that 

display information to prevent unauthorized individuals from observing the display 

output. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

access control for display medium; facility layout of information system components; other 

relevant documents or records]. (M) (H)

APPENDIX F - PE PAGE F-166 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-6 MONITORING PHYSICAL ACCESS 

Control: The organization monitors physical access to the information system to detect 

and respond to physical security incidents. 

Supplemental Guidance: The organization reviews physical access logs periodically and 

investigates apparent security violations or suspicious physical access activities. 

Response to detected physical security incidents is part of the organization’s incident 

response capability. 

PE-6.1 ASSESSMENT OBJECTIVE:

Determine if the organization monitors physical access to the information system to 

detect and respond to physical security incidents. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access monitoring; physical access logs or records; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with physical access monitoring responsibilities]. 

(M) (H)

Test: [SELECT FROM: Physical access monitoring capability]. (M) (H)

APPENDIX F - PE PAGE F-167 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-6(1) MONITORING PHYSICAL ACCESS 

Control Enhancement:

The organization monitors real-time physical intrusion alarms and surveillance equipment. 

PE-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization monitors real-time intrusion alarms and surveillance 

equipment. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: Physical and environmental protection policy; procedures addressing physical access 

monitoring; intrusion alarm/surveillance equipment logs or records; other relevant 

documents or records. (M) (H)

Interview: Organizational personnel with physical access monitoring responsibilities. (H)

PE-6(2) MONITORING PHYSICAL ACCESS 

Control Enhancement:

The organization employs automated mechanisms to recognize potential intrusions and 

initiate appropriate response actions. 

PE-6(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to recognize potential 

intrusions and initiate appropriate response actions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

physical access monitoring; information system design documentation; other relevant 

documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing physical access monitoring capability]. (H)

APPENDIX F - PE PAGE F-168 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-7 VISITOR CONTROL 

Control: The organization controls physical access to the information system by 

authenticating visitors before authorizing access to the facility where the information 

system resides other than areas designated as publicly accessible. 

Supplemental Guidance: Government contractors and others with permanent authorization 

credentials are not considered visitors. Personal Identity Verification (PIV) credentials 

for federal employees and contractors conform to FIPS 201, and the issuing organizations 

for the PIV credentials are accredited in accordance with the provisions of NIST Special 

Publication 800-79. 

PE-7.1 ASSESSMENT OBJECTIVE:

Determine if the organization controls physical access to the information system by 

authenticating visitors before authorizing access to the facility where the information 

system resides other than areas designated as publicly accessible. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing visitor 

access control; visitor access control logs or records; other relevant documents or records]. 

(L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with visitor access control responsibilities]. (H)

Test: [SELECT FROM: Visitor access control capability]. (M) (H)

APPENDIX F - PE PAGE F-169 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-7(1) VISITOR CONTROL 

Control Enhancement:

The organization escorts visitors and monitors visitor activity, when required. 

PE-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization escorts visitors and monitors visitor activity, when 

required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing visitor 

access control; visitor access control logs or records; other relevant documents or records]. 

(M) (H)

Interview: [SELECT FROM: Organizational personnel with visitor access control responsibilities]. (H)

APPENDIX F - PE PAGE F-170 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-8 ACCESS RECORDS 

Control: The organization maintains visitor access records to the facility where the 

information system resides (except for those areas within the facility officially designated 

as publicly accessible) that includes: (i) name and organization of the person visiting; (ii) 

signature of the visitor; (iii) form of identification; (iv) date of access; (v) time of entry 

and departure; (vi) purpose of visit; and (vii) name and organization of person visited. 

Designated officials within the organization review the visitor access records 

[Assignment: organization-defined frequency]. 

Supplemental Guidance: None. 

PE-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of review for visitor access records; 

(ii) the organization maintains visitor access records to the facility where the 

information system resides (except for those areas within the facility officially 

designated as publicly accessible) that includes: 

- name and organization of the person visiting; 

- signature of the visitor; 

- form of identification; 

- date of access; 

- time of entry and departure; 

- purpose of visit; 

- name and organization of person visited and 

(iii) designated officials within the organization review the visitor access logs in 

accordance with organization-defined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing facility 

access records; information system security plan; facility access control records; other 

relevant documents or records]. (L) (M) (H)

APPENDIX F - PE PAGE F-171 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-8(1) ACCESS RECORDS 

Control Enhancement:

The organization employs automated mechanisms to facilitate the maintenance and review of 

access records. 

PE-8(1).1 ASSESSMENT OBJECTIVE:

Determine the organization employs automated mechanisms to facilitate the maintenance 

and review of access records. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing facility 

access records; automated mechanisms supporting management of access records; facility 

access control logs or records; other relevant documents or records]. (H)

PE-8(2) ACCESS RECORDS 

Control Enhancement:

The organization maintains a record of all physical access, both visitor and authorized 

individuals. 

PE-8(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization maintains a record of all physical access, both visitor and 

authorized individuals. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing facility 

access records; facility access control logs or records; other relevant documents or 

records]. (H)

APPENDIX F - PE PAGE F-172 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-9 POWER EQUIPMENT AND POWER CABLING 

Control: The organization protects power equipment and power cabling for the 

information system from damage and destruction. 

Supplemental Guidance: None. 

PE-9.1 ASSESSMENT OBJECTIVE:

Determine if the organization protects power equipment and power cabling for the 

information system from damage and destruction. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing power 

equipment and cabling protection; facility housing power equipment and cabling; other 

relevant documents or records]. (M) (H)

APPENDIX F - PE PAGE F-173 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-9(1) POWER EQUIPMENT AND POWER CABLING 

Control Enhancement:

The organization employs redundant and parallel power cabling paths. 

PE-9(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs redundant and parallel power cabling paths. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing power 

equipment and cabling protection; facility housing power equipment and cabling; other 

relevant documents or records]. 

APPENDIX F - PE PAGE F-174 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-10 EMERGENCY SHUTOFF 

Control: The organization provides, for specific locations within a facility containing 

concentrations of information system resources, the capability of shutting off power to 

any information system component that may be malfunctioning or threatened without 

endangering personnel by requiring them to approach the equipment. 

Supplemental Guidance: Facilities containing concentrations of information system 

resources may include, for example, data centers, server rooms, and mainframe rooms. 

PE-10.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the specific locations within a facility containing 

concentrations of information system resources (e.g., data centers, server rooms, 

mainframe rooms); and 

(ii) the organization provides, for specific locations within a facility containing 

concentrations of information system resources, the capability of shutting off power 

to any information system component that may be malfunctioning or threatened 

without endangering personnel by requiring them to approach the equipment. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing power 

source emergency shutoff; emergency shutoff controls or switches; other relevant 

documents or records]. (M) (H)

APPENDIX F - PE PAGE F-175 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-10(1) EMERGENCY SHUTOFF 

Control Enhancement:

The organization protects the emergency power-off capability from accidental or unauthorized 

activation. 

PE-10(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization protects the emergency power-off capability from 

accidental or unauthorized activation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing power 

source emergency shutoff; emergency shutoff controls or switches; other relevant 

documents or records]. (H)

APPENDIX F - PE PAGE F-176 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-11 EMERGENCY POWER 

Control: The organization provides a short-term uninterruptible power supply to facilitate 

an orderly shutdown of the information system in the event of a primary power source 

loss. 

Supplemental Guidance: None. 

PE-11.1 ASSESSMENT OBJECTIVE:

Determine if the organization provides a short-term uninterruptible power supply to 

facilitate an orderly shutdown of the information system in the event of a primary power 

source loss. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

emergency power; uninterruptible power supply documentation; other relevant documents 

or records]. (M) (H)

Test: [SELECT FROM: Uninterruptible power supply]. (H)

APPENDIX F - PE PAGE F-177 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-11(1) EMERGENCY POWER 

Control Enhancement:

The organization provides a long-term alternate power supply for the information system that 

is capable of maintaining minimally required operational capability in the event of an extended 

loss of the primary power source. 

PE-11(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization provides a long-term alternate power supply for the 

information system that is capable of maintaining minimally required operational 

capability in the event of an extended loss of the primary power source. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

emergency power; alternate power supply documentation; alternate power test records; 

other relevant documents or records]. (H)

Test: [SELECT FROM: Alternate power supply]. (H)

PE-11(2) EMERGENCY POWER 

Control Enhancement:

The organization provides a long-term alternate power supply for the information system that 

is self-contained and not reliant on external power generation. 

PE-11(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization provides a long-term alternate power supply for the 

information system that is self-contained and not reliant on external power generation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

emergency power; alternate power supply documentation; alternate power test records; 

other relevant documents or records]. 

Test: [SELECT FROM: Alternate power supply].

APPENDIX F - PE PAGE F-178 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-12 EMERGENCY LIGHTING 

Control: The organization employs and maintains automatic emergency lighting that 

activates in the event of a power outage or disruption and that covers emergency exits and 

evacuation routes. 

Supplemental Guidance: None. 

PE-12.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs and maintains automatic emergency lighting systems that 

activates in the event of a power outage or disruption; and 

(ii) the organization employs and maintains automatic emergency lighting systems that 

cover emergency exits and evacuation routes. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

emergency lighting; emergency lighting documentation; emergency lighting test records; 

emergency exits and evacuation routes; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Emergency lighting capability]. (M) (H)

APPENDIX F - PE PAGE F-179 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-13 FIRE PROTECTION 

Control: The organization employs and maintains fire suppression and detection 

devices/systems that can be activated in the event of a fire. 

Supplemental Guidance: Fire suppression and detection devices/systems include, but are 

not limited to, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke 

detectors. 

PE-13.1 ASSESSMENT OBJECTIVE:

Determine if the organization employs and maintains fire suppression and detection 

devices/systems that can be activated in the event of a fire. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing fire 

protection; fire suppression and detection devices/systems; fire suppression and detection 

devices/systems documentation; test records of fire suppression and detection 

devices/systems; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PE PAGE F-180 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-13(1) FIRE PROTECTION 

Control Enhancement:

The organization employs fire detection devices/systems that activate automatically and notify 

the organization and emergency responders in the event of a fire. 

PE-13(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs fire detection devices/systems that activate automatically; 

and 

(ii) the organization employs fire detection devices/systems that notify the organization 

and emergency responders in the event of a fire. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing fire 

protection; facility housing the information system; alarm service level agreements; test 

records of fire suppression and detection devices/systems; fire suppression and detection 

devices/systems documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Simulated fire detection and automated notifications]. (H)

PE-13(2) FIRE PROTECTION 

Control Enhancement:

The organization employs fire suppression devices/systems that provide automatic 

notification of any activation to the organization and emergency responders. 

PE-13(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs fire suppression devices/systems that provide 

automatic notification of any activation to the organization and emergency responders. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing fire 

protection; fire suppression and detection devices/systems documentation; facility housing 

the information system; alarm service level agreements; test records of fire suppression 

and detection devices/systems; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Simulated activation of fire suppression devices/systems and automated 

notifications]. (H)

APPENDIX F - PE PAGE F-181 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-13(3) FIRE PROTECTION 

Control Enhancement:

The organization employs an automatic fire suppression capability in facilities that are not 

staffed on a continuous basis. 

PE-13(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs an automatic fire suppression capability in 

facilities that are not staffed on a continuous basis. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing fire 

protection; facility housing the information system; alarm service level agreements; facility 

staffing plans; test records of fire suppression and detection devices/systems; other 

relevant documents or records]. (M) (H)

Test: [SELECT FROM: Simulated activation of fire suppression devices/systems and automated 

notifications]. (H)

APPENDIX F - PE PAGE F-182 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-14 TEMPERATURE AND HUMIDITY CONTROLS 

Control: The organization regularly maintains, within acceptable levels, and monitors the 

temperature and humidity within the facility where the information system resides. 

Supplemental Guidance: None. 

PE-14.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization regularly maintains, within acceptable levels, the temperature and 

humidity within the facility where the information system resides; and 

(ii) the organization regularly monitors the temperature and humidity within the facility 

where the information system resides. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

temperature and humidity control; facility housing the information system; temperature and 

humidity controls; temperature and humidity controls documentation; temperature and 

humidity records; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PE PAGE F-183 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-15 WATER DAMAGE PROTECTION 

Control: The organization protects the information system from water damage resulting 

from broken plumbing lines or other sources of water leakage by providing master shutoff 

valves that are accessible, working properly, and known to key personnel. 

Supplemental Guidance: None. 

PE-15.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies key personnel with knowledge of location and 

operational procedures for activating master shutoff valves for plumbing system; 

and 

(ii) the organization protects the information system from water damage resulting from 

broken plumbing lines or other sources of water leakage by providing master 

shutoff valves that are accessible, working properly, and known to key personnel. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing water 

damage protection; facility housing the information system; master shutoff values; list of 

key personnel with knowledge of location and activation procedures for master shutoff 

values for the plumbing system; master shutoff value documentation; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organization personnel with physical and environmental protection 

responsibilities]. (M) (H)

Test: [SELECT FROM: Simulated master water shutoff value activation for the plumbing system]. (M) (H)

APPENDIX F - PE PAGE F-184 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-15(1) WATER DAMAGE PROTECTION 

Control Enhancement:

The organization employs mechanisms that, without the need for manual intervention, protect 

the information system from water damage in the event of a significant water leak. 

PE-15(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs mechanisms that, without the need for manual 

intervention, protect the information system from water damage in the event of a 

significant water leak. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing water 

damage protection; facility housing the information system; automated mechanisms for 

water shutoff valves; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing master water shutoff valve activation]. (H)

APPENDIX F - PE PAGE F-185 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-16 DELIVERY AND REMOVAL 

Control: The organization authorizes and controls information system-related items 

entering and exiting the facility and maintains appropriate records of those items. 

Supplemental Guidance: The organization controls delivery areas and, if possible, isolates 

the areas from the information system and media libraries to avoid unauthorized physical 

access. 

PE-16.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization controls information system-related items (i.e., hardware, 

firmware, software) entering and exiting the facility; and 

(ii) the organization maintains appropriate records of items entering and exiting the 

facility. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

delivery and removal of information system components from the facility; facility housing 

the information system; records of items entering and exiting the facility; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organization personnel with tracking responsibilities for information system 

components entering and exiting the facility]. (M) (H)

APPENDIX F - PE PAGE F-186 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-17 ALTERNATE WORK SITE 

Control: The organization employs appropriate management, operational, and technical 

information system security controls at alternate work sites. 

Supplemental Guidance: The organization provides a means for employees to communicate 

with information system security staff in case of security problems. NIST Special 

Publication 800-46 provides guidance on security in telecommuting and broadband 

communications. 

PE-17.1 ASSESSMENT OBJECTIVE:

Determine if the organization employs appropriate management, operational, and 

technical information system security controls at alternate work sites. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

alternate work sites for organizational personnel; list of management, operational, and 

technical security controls required for alternate work sites; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organization personnel using alternate work sites]. (M) (H)

APPENDIX F - PE PAGE F-187 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-18 LOCATION OF INFORMATION SYSTEM COMPONENTS 

Control: The organization positions information system components within the facility to 

minimize potential damage from physical and environmental hazards and to minimize the 

opportunity for unauthorized access. 

Supplemental Guidance: Physical and environmental hazards include, for example, 

flooding, fire, tornados, earthquakes, hurricanes, acts of terrorism, vandalism, electrical 

interference, and electromagnetic radiation. Whenever possible, the organization also 

considers the location or site of the facility with regard to physical and environmental 

hazards. 

PE-18.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization positions information system components within the facility to 

minimize potential damage from physical and environmental hazards; and 

(ii) the organization positions information system components within the facility to 

minimize the opportunity for unauthorized access. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

positioning of information system components; documentation providing the location and 

position of information system components within the facility; other relevant documents or 

records]. (M) (H)

 

APPENDIX F - PE PAGE F-188 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-18(1) LOCATION OF INFORMATION SYSTEM COMPONENTS 

Control Enhancement:

The organization plans the location or site of the facility where the information system resides 

with regard to physical and environmental hazards and for existing facilities, considers the 

physical and environmental hazards in its risk mitigation strategy. 

PE-18(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization plans the location or site of the facility where the information 

system resides with regard to physical and environmental hazards; and 

(ii) the organization, for existing facilities, considers the physical and environmental 

hazards in its risk mitigation strategy. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; physical site planning 

documents; organizational assessment of risk, contingency plan; other relevant documents 

or records]. (H)

Interview: [SELECT FROM: Organization personnel with site selection responsibilities for the facility 

housing the information system]. (H)

 

APPENDIX F - PE PAGE F-189 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - PE PAGE F-190 

FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

PE-19 INFORMATION LEAKAGE 

Control: The organization protects the information system from information leakage due 

to electromagnetic signals emanations. 

Supplemental Guidance: The FIPS 199 security categorization (for confidentiality) of the 

information system and organizational security policy guides the application of 

safeguards and countermeasures employed to protect the information system against 

information leakage due to electromagnetic signals emanations. 

PE-19.1 ASSESSMENT OBJECTIVE:

Determine if the organization protects the information system from information leakage 

due to electromagnetic signals emanations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing 

information leakage due to electromagnetic signals emanations; mechanisms protecting 

the information system against electronic signals emanation; facility housing the 

information system; records from electromagnetic signals emanation tests; other relevant 

documents or records]. 

Test: [SELECT FROM: Information system for information leakage due to electromagnetic signals 

emanations].
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-1 SECURITY PLANNING POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, security planning policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the security planning policy and associated security planning controls. 

Supplemental Guidance: The security planning policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The security planning policy addresses the overall policy requirements for 

confidentiality, integrity, and availability and can be included as part of the general 

information security policy for the organization. Security planning procedures can be 

developed for the security program in general, and for a particular information system, 

when required. NIST Special Publication 800-18 provides guidance on security planning. 

NIST Special Publication 800-12 provides guidance on security policies and procedures. 

PL-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents security planning policy and procedures; 

(ii) the organization disseminates security planning policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review security planning 

policy and procedures; and 

(iv) the organization updates security planning policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security planning and 

plan implementation responsibilities]. (H)

PL-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the security planning policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the security planning policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the security planning procedures address all areas identified in the security 

planning policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security planning and 

plan implementation responsibilities]. (H)

APPENDIX F - PL PAGE F-191 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-2 SYSTEM SECURITY PLAN 

Control: The organization develops and implements a security plan for the information 

system that provides an overview of the security requirements for the system and a 

description of the security controls in place or planned for meeting those requirements. 

Designated officials within the organization review and approve the plan. 

Supplemental Guidance: The security plan is aligned with the organization’s information 

system architecture and information security architecture. NIST Special Publication 800-

18 provides guidance on security planning. 

PL-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and implements a security plan for the information 

system; 

(ii) the security plan provides an overview of the security requirements for the 

information system and a description of the security controls planned or in place for 

meeting the security requirements; 

(iii) the security plan development is consistent with NIST Special Publication 800-18 

and the concepts in the NIST Risk Management Framework including baseline 

security control selection, tailoring of the baseline, and supplementation of the 

tailored baseline; 

(iv) the security plan is consistent with the organization’s information system 

architecture and information security architecture; and 

(v) designated organizational officials review and approve the security plan. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing information system security 

plan development and implementation; NIST Special Publication 800-18; security plan for 

the information system; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security planning and 

plan implementation responsibilities]. (M) (H)

APPENDIX F - PL PAGE F-192 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-3 SYSTEM SECURITY PLAN UPDATE 

Control: The organization reviews the security plan for the information system 

[Assignment: organization-defined frequency, at least annually] and revises the plan to 

address system/organizational changes or problems identified during plan implementation 

or security control assessments. 

Supplemental Guidance: Significant changes are defined in advance by the organization and 

identified in the configuration management process. NIST Special Publication 800-18 

provides guidance on security plan updates. 

PL-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of information system security plan reviews 

and updates; 

(ii) the organization updates the security plan in accordance with organization-defined 

frequency, at least annually; 

(iii) the organization receives input to update the security plan from the organization’s 

configuration management and control process; and 

(iv) the updated security plan reflects the information system and organizational 

changes or problems identified during the implementation of the plan or the 

assessment of the security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing information system security 

plan updates; information system security plan; configuration management policy and 

procedures; configuration management documents; security plan for the information 

system; record of security plan reviews and updates; other relevant documents or records]. 

(L) (M) (H)

APPENDIX F - PL PAGE F-193 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-4 RULES OF BEHAVIOR 

Control: The organization establishes and makes readily available to all information 

system users, a set of rules that describes their responsibilities and expected behavior with 

regard to information and information system usage. The organization receives signed 

acknowledgement from users indicating that they have read, understand, and agree to 

abide by the rules of behavior, before authorizing access to the information system and its 

resident information. 

Supplemental Guidance: Electronic signatures are acceptable for use in acknowledging 

rules of behavior unless specifically prohibited by organizational policy. NIST Special 

Publication 800-18 provides guidance on preparing rules of behavior. 

PL-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes a set of rules that describe user responsibilities and 

expected behavior with regard to information system usage; 

(ii) the organization makes the rules available to all information system users; 

(iii) the rules of behavior for organizational personnel are consistent with NIST Special 

Publication 800-18; and 

(iv) the organization receives a signed acknowledgement from users indicating that they 

have read, understand, and agree to abide by the rules of behavior, before 

authorizing access to the information system and its resident information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing rules of behavior for 

information system users; NIST Special Publication 800-18; rules of behavior; other 

relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel who are authorized users of the information 

system and have signed rules of behavior]. (M) (H)

APPENDIX F - PL PAGE F-194 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-5 PRIVACY IMPACT ASSESSMENT 

Control: The organization conducts a privacy impact assessment on the information 

system in accordance with OMB policy. 

Supplemental Guidance: OMB Memorandum 03-22 provides guidance for implementing 

the privacy provisions of the E-Government Act of 2002. 

PL-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization conducts a privacy impact assessment on the information system in 

accordance with OMB policy; and 

(ii) the privacy impact assessment is consistent with federal legislation and OMB policy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing privacy impact 

assessments on the information system; appropriate federal legislation and OMB policy; 

privacy impact assessment; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PL PAGE F-195 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - PL PAGE F-196 

FAMILY: PLANNING CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

PL-6 SECURITY-RELATED ACTIVITY PLANNING 

Control: The organization plans and coordinates security-related activities affecting the 

information system before conducting such activities in order to reduce the impact on 

organizational operations (i.e., mission, functions, image, and reputation), organizational 

assets, and individuals. 

Supplemental Guidance: Routine security-related activities include, but are not limited to, 

security assessments, audits, system hardware and software maintenance, security 

certifications, and testing/exercises. Organizational advance planning and coordination 

includes both emergency and non-emergency (i.e., routine) situations. 

PL-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization plans and coordinates security-related activities affecting the 

information system before conducting such activities in order to reduce the impact 

on organizational operations, organizational assets, and individuals; and 

(ii) the organization’s advance planning and coordination of security-related activities 

includes both emergency and non-emergency situations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security planning policy; procedures addressing security-related activity 

planning for the information system; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security planning and 

plan implementation responsibilities]. (M) (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-1 PERSONNEL SECURITY POLICY AND PROCEDURES 

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, personnel security policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the personnel security policy and associated personnel security controls. 

Supplemental Guidance: The personnel security policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The personnel security policy can be included as part of the general 

information security policy for the organization. Personnel security procedures can be 

developed for the security program in general, and for a particular information system, 

when required. NIST Special Publication 800-12 provides guidance on security policies 

and procedures. 

PS-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents personnel security policy and procedures; 

(ii) the organization disseminates personnel security policy and procedures to 

appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review personnel security 

policy and procedures; and 

(iv) the organization updates personnel security policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy and procedures, other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities]. (H)

PS-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the personnel security policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the personnel security policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the personnel security procedures address all areas identified in the personnel 

security policy and address achieving policy-compliant implementations of all 

associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities]. (H)

APPENDIX F - PS PAGE F-197 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-2 POSITION CATEGORIZATION 

Control: The organization assigns a risk designation to all positions and establishes 

screening criteria for individuals filling those positions. The organization reviews and 

revises position risk designations [Assignment: organization-defined frequency].

Supplemental Guidance: Position risk designations are consistent with 5 CFR 731.106(a) 

and Office of Personnel Management policy and guidance. 

PS-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization assigns a risk designations to all positions within the organization; 

(ii) the organization establishes a screening criteria for individuals filling 

organizational positions; 

(iii) the risk designations for the organizational positions are consistent with applicable 

federal regulations and OPM policy and guidance; 

(iv) the organization defines the frequency of risk designation reviews and updates for 

organizational positions; and 

(v) the organization reviews and revises position risk designations in accordance with 

the organization-defined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing position categorization; 

appropriate codes of federal regulations; OPM policy and guidance; list of risk designations 

for organizational positions; information system security plan; records of risk designation 

reviews and updates; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PS PAGE F-198 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-3 PERSONNEL SCREENING 

Control: The organization screens individuals requiring access to organizational 

information and information systems before authorizing access. 

Supplemental Guidance: Screening is consistent with: (i) 5 CFR 731.106; (ii) Office of 

Personnel Management policy, regulations, and guidance; (iii) organizational policy, 

regulations, and guidance; (iv) FIPS 201 and Special Publications 800-73, 800-76, and 

800-78; and (v) the criteria established for the risk designation of the assigned position. 

PS-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization screens individuals requiring access to organizational information 

and information systems prior to authorizing access; and 

(ii) the personnel screening is consistent with appropriate legislation, OPM policy, 

regulations, and guidance, FIPS 201 and NIST Special Publications 800-73, 800-

76, and 800-78, and the criteria established for the risk designation for the assigned 

position. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel screening; 

records of screened personnel; FIPS 201; NIST Special Publications 800-73, 800-76, and 

800-78; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PS PAGE F-199 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-4 PERSONNEL TERMINATION 

Control: The organization, upon termination of individual employment, terminates 

information system access, conducts exit interviews, retrieves all organizational 

information system-related property, and provides appropriate personnel with access to 

official records created by the terminated employee that are stored on organizational 

information systems. 

Supplemental Guidance: Information system-related property includes, for example, keys, 

identification cards, and building passes. Timely execution of this control is particularly 

essential for employees or contractors terminated for cause. 

PS-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization terminates information system access upon termination of 

individual employment; 

(ii) the organization conducts exit interviews of terminated personnel; 

(iii) the organization retrieves all organizational information system-related property 

from terminated personnel; and 

(iv) the organization retains access to official documents and records on organizational 

information systems created by terminated personnel. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel termination; 

records of personnel termination actions; list of information system accounts; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities]. (M) (H)

APPENDIX F - PS PAGE F-200 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-5 PERSONNEL TRANSFER

Control: The organization reviews information systems/facilities access authorizations 

when personnel are reassigned or transferred to other positions within the organization 

and initiates appropriate actions. 

Supplemental Guidance: Appropriate actions that may be required include: (i) returning old 

and issuing new keys, identification cards, building passes; (ii) closing old accounts and 

establishing new accounts; (iii) changing system access authorizations; and (iv) providing 

for access to official records created or controlled by the employee at the old work 

location and in the old accounts. 

PS-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization reviews information systems/facilities access authorizations when 

personnel are reassigned or transferred to other positions within the organization; 

and 

(ii) the organization initiates appropriate actions (e.g., reissuing keys, identification 

cards, building passes; closing old accounts and establishing new accounts; and 

changing system access authorization) for personnel reassigned or transferred 

within the organization. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel transfer; 

records of personnel transfer actions; list of information system and facility access 

authorizations; other relevant documents or records]. (L) (M) (H)

APPENDIX F - PS PAGE F-201 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-6 ACCESS AGREEMENTS 

Control: The organization completes appropriate signed access agreements for individuals 

requiring access to organizational information and information systems before 

authorizing access and reviews/updates the agreements [Assignment: organizationdefined frequency]. 

Supplemental Guidance: Access agreements include, for example, nondisclosure 

agreements, acceptable use agreements, rules of behavior, and conflict-of-interest 

agreements. Electronic signatures are acceptable for use in acknowledging access 

agreements unless specifically prohibited by organizational policy. 

PS-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization completes appropriate access agreements for individuals requiring 

access to organizational information and information systems before authorizing 

access; 

(ii) organizational personnel sign access agreements; 

(iii) the organization defines the frequency of reviews and updates for access 

agreements; and 

(iv) the organization reviews and updates the access agreements in accordance with the 

organization-defined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing access agreements for 

organizational information and information systems; information system security plan; 

access agreements; records of access agreement reviews and updates; other relevant 

documents or records]. (L) (M) (H)

APPENDIX F - PS PAGE F-202 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-7 THIRD-PARTY PERSONNEL SECURITY 

Control: The organization establishes personnel security requirements including security 

roles and responsibilities for third-party providers and monitors provider compliance. 

Supplemental Guidance: Third-party providers include, for example, service bureaus, 

contractors, and other organizations providing information system development, 

information technology services, outsourced applications, and network and security 

management. The organization explicitly includes personnel security requirements in 

acquisition-related documents. NIST Special Publication 800-35 provides guidance on 

information technology security services. 

PS-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes personnel security requirements, including security 

roles and responsibilities, for third-party providers (e.g., service bureaus, 

contractors, and other organizations providing information system development, 

information technology services, outsourced applications, network and security 

management); 

(ii) the organization explicitly includes personnel security requirements in acquisitionrelated documents in accordance with NIST Special Publication 800-35; and 

(iii) the organization monitors third-party provider compliance with personnel security 

requirements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing third-party personnel 

security; list of personnel security requirements; acquisition documents; compliance 

monitoring process; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities; third-party 

providers]. (M) (H)

APPENDIX F - PS PAGE F-203 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - PS PAGE F-204 

FAMILY: PERSONNEL SECURITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

PS-8 PERSONNEL SANCTIONS 

Control: The organization employs a formal sanctions process for personnel failing to 

comply with established information security policies and procedures. 

Supplemental Guidance: The sanctions process is consistent with applicable laws, 

Executive Orders, directives, policies, regulations, standards, and guidance. The 

sanctions process can be included as part of the general personnel policies and procedures 

for the organization. 

PS-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization employs a formal sanctions process for personnel failing to comply 

with established information security policies and procedures; and 

(ii) the personnel sanctions process is consistent with applicable laws, Executive 

Orders, directives, policies, regulations, standards, and guidance. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel sanctions; rules 

of behavior; records of formal sanctions; other relevant documents or records]. (L) (M) (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-1 RISK ASSESSMENT POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented risk assessment policy that addresses purpose, scope, roles, 

responsibilities, management commitment, coordination among organizational entities, 

and compliance; and (ii) formal, documented procedures to facilitate the implementation 

of the risk assessment policy and associated risk assessment controls. 

Supplemental Guidance: The risk assessment policy and procedures are consistent with 

applicable laws, Executive Orders, directives, policies, regulations, standards, and 

guidance. The risk assessment policy can be included as part of the general information 

security policy for the organization. Risk assessment procedures can be developed for the 

security program in general, and for a particular information system, when required. 

NIST Special Publications 800-30 provides guidance on the assessment of risk. NIST 

Special Publication 800-12 provides guidance on security policies and procedures. 

RA-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents risk assessment policy and procedures; 

(ii) the organization disseminates risk assessment policy and procedures to appropriate 

elements within the organization; 

(iii) responsible parties within the organization periodically review risk assessment 

policy and procedures; and 

(iv) the organization updates risk assessment policy and procedures when 

organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with risk assessment responsibilities]. (H)

RA-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the risk assessment policy addresses purpose, scope, roles and responsibilities, 

management commitment, coordination among organizational entities, and 

compliance; 

(ii) the risk assessment policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and 

(iii) the risk assessment procedures address all areas identified in the risk assessment 

policy and address achieving policy-compliant implementations of all associated 

security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy and procedures; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with risk assessment responsibilities]. (H)

APPENDIX F - RA PAGE F-205 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-2 SECURITY CATEGORIZATION 

Control: The organization categorizes the information system and the information 

processed, stored, or transmitted by the system in accordance with applicable laws, 

Executive Orders, directives, policies, regulations, standards, and guidance and 

documents the results (including supporting rationale) in the system security plan. 

Designated senior-level officials within the organization review and approve the security 

categorizations.

Supplemental Guidance: The applicable federal standard for security categorization of 

nonnational security information and information systems is FIPS 199. The organization 

conducts FIPS 199 security categorizations as an organization-wide activity with the 

involvement of the chief information officer, senior agency information security officer, 

information system owners, and information owners. The organization also considers 

potential impacts to other organizations and, in accordance with the USA PATRIOT Act 

of 2001 and Homeland Security Presidential Directives, potential national-level impacts 

in categorizing the information system. As part of a defense-in-depth protection strategy, 

the organization considers partitioning higher-impact information systems into separate 

physical domains (or environments) and restricting or prohibiting network access in 

accordance with an organizational assessment of risk. NIST Special Publication 800-60 

provides guidance on determining the security categories of the information types 

resident on the information system. Related security controls: MP-4, SC-7. 

RA-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization conducts the security categorization of the information system as 

an organization-wide exercise with the involvement of senior-level officials 

including, but not limited to, authorizing officials, information system owners, chief 

information officer, senior agency information security officer, and 

mission/information owners; 

(ii) the security categorization is consistent with FIPS 199 and NIST Special 

Publication 800-60; 

(iii) the organization considers in the security categorization of the information system, 

potential impacts to other organizations and, in accordance with the USA PATRIOT 

Act of 2001 and Homeland Security Presidential Directives, potential national-level 

impacts; 

(iv) the organization includes supporting rationale for impact-level decisions as part of 

the security categorization; and 

(v) designated, senior-level organizational officials review and approve the security 

categorization of the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; procedures addressing security categorization of 

organizational information and information systems; security planning policy and 

procedures; FIPS 199; NIST Special Publication 800-60; information system security plan; 

other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security categorization and risk assessment 

responsibilities]. (M) (H)

APPENDIX F - RA PAGE F-206 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-3 RISK ASSESSMENT 

Control: The organization conducts assessments of the risk and magnitude of harm that 

could result from the unauthorized access, use, disclosure, disruption, modification, or 

destruction of information and information systems that support the operations and assets 

of the agency (including information and information systems managed/operated by 

external parties). 

Supplemental Guidance: Risk assessments take into account vulnerabilities, threat sources, 

and security controls planned or in place to determine the resulting level of residual risk 

posed to organizational operations, organizational assets, or individuals based on the 

operation of the information system. The organization also considers potential impacts to 

other organizations and, in accordance with the USA PATRIOT Act and Homeland 

Security Presidential Directives, potential national-level impacts in categorizing the 

information system. Risk assessments also take into account risk posed to organizational 

operations, organizational assets, or individuals from external parties (e.g., service 

providers, contractors operating information systems on behalf of the organization, 

individuals accessing organizational information systems, outsourcing entities). In 

accordance with OMB policy and related E-authentication initiatives, authentication of 

public users accessing federal information systems may also be required to protect 

nonpublic or privacy-related information. As such, organizational assessments of risk 

also address public access to federal information systems. The General Services 

Administration provides tools supporting that portion of the risk assessment dealing with 

public access to federal information systems. NIST Special Publication 800-30 provides 

guidance on conducting risk assessments including threat, vulnerability, and impact 

assessments. 

RA-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization assesses the risk and magnitude of harm that could result from the 

unauthorized access, use, disclosure, disruption, modification, or destruction of 

information and information systems that support its operations and assets 

(including information and information systems managed/operated by external 

parties); and 

(ii) the risk assessment is consistent with the NIST Special Publication 800-30. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; security planning policy and procedures; 

procedures addressing organizational assessments of risk; risk assessment; NIST Special 

Publication 800-30; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with risk assessment responsibilities]. (M) (H)

APPENDIX F - RA PAGE F-207 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-4 RISK ASSESSMENT UPDATE 

Control: The organization updates the risk assessment [Assignment: organization-defined 

frequency] or whenever there are significant changes to the information system, the 

facilities where the system resides, or other conditions that may impact the security or 

accreditation status of the system. 

Supplemental Guidance: The organization develops and documents specific criteria for 

what is considered significant change to the information system. NIST Special 

Publication 800-30 provides guidance on conducting risk assessment updates. 

RA-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of risk assessment updates; 

(ii) the organization updates the risk assessment in accordance with the organizationdefined frequency or whenever there are significant changes to the information 

system, the facilities where the system resides, or other conditions that may impact 

the security or accreditation status of the system; 

(iii) the risk assessment update is consistent with the NIST Special Publications 800-30; 

and 

(iv) the revised risk assessment reflects the needed changes based on the organization’s 

experiences during security plan implementation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; security planning policy and procedures; 

procedures addressing risk assessment updates; risk assessment; information system 

security plan; records of risk assessment updates; NIST Special Publication 800-30; other 

relevant documents or records]. (L) (M) (H)

APPENDIX F - RA PAGE F-208 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-5 VULNERABILITY SCANNING 

Control: The organization scans for vulnerabilities in the information system [Assignment: 

organization-defined frequency] or when significant new vulnerabilities potentially 

affecting the system are identified and reported. 

Supplemental Guidance: Vulnerability scanning is conducted using appropriate scanning 

tools and techniques. The organization trains selected personnel in the use and 

maintenance of vulnerability scanning tools and techniques. Vulnerability scans are 

scheduled and/or random in accordance with organizational policy and assessment of risk. 

The information obtained from the vulnerability scanning process is freely shared with 

appropriate personnel throughout the organization to help eliminate similar vulnerabilities 

in other information systems. Vulnerability analysis for custom software and applications 

may require additional, more specialized approaches (e.g., vulnerability scanning tools for 

applications, source code reviews, static analysis of source code). NIST Special 

Publication 800-42 provides guidance on network security testing. NIST Special 

Publication 800-40 (Version 2) provides guidance on patch and vulnerability 

management. 

RA-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of vulnerability scans within the information 

system; 

(ii) the organization scans for vulnerabilities in the information system in accordance 

with the organization-defined frequency or when significant new vulnerabilities 

affecting the system are identified and reported; 

(iii) the organization uses appropriate scanning tools and techniques to conduct the 

vulnerability scans including those tools that ensure interoperability among tools 

and automate parts of the vulnerability management process by using standards for 

(a) enumerating platforms, software flaws, and improper configurations, (b) 

formatting and making transparent checklists and test procedures, and (c) 

measuring vulnerability impact; 

(iv) the organization performs network vulnerability scanning in accordance with NIST 

Special Publication 800-42; and 

(v) the organization handles patch and vulnerability management in accordance with 

NIST Special Publication 800-40. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk 

assessment; information system security plan; vulnerability scanning results; patch and 

vulnerability management records; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with risk assessment and vulnerability scanning 

responsibilities]. (H)

APPENDIX F - RA PAGE F-209 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-5(1) VULNERABILITY SCANNING 

Control Enhancement:

The organization employs vulnerability scanning tools that include the capability to readily 

update the list of information system vulnerabilities scanned.

RA-5(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization uses vulnerability scanning tools that have the capability to readily 

update the list of information system vulnerabilities scanned; and 

(ii) the vulnerability scanning tools retrieve updated lists of information system 

vulnerabilities from the National Vulnerability Database (NVD). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk 

assessment; vulnerability scanning tools and techniques documentation; vulnerability 

scanning results; patch and vulnerability management records; other relevant documents 

or records]. (H)

Test: [SELECT FROM: Vulnerability scanning capability and associated scanning tools]. (H)

RA-5(2) VULNERABILITY SCANNING 

Control Enhancement:

The organization updates the list of information system vulnerabilities scanned [Assignment: 

organization-defined frequency] or when significant new vulnerabilities are identified and 

reported.

RA-5(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of updates for information system 

vulnerabilities scanned; and 

(ii) the organization updates the list of information system vulnerabilities scanned in 

accordance with the organization-defined frequency or when significant new 

vulnerabilities are identified and reported. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk 

assessment; information system security plan; list of vulnerabilities scanned; records of 

updates to vulnerabilities scanned; other relevant documents or records]. (H)

APPENDIX F - RA PAGE F-210 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - RA PAGE F-211 

FAMILY: RISK ASSESSMENT CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

RA-5(3) VULNERABILITY SCANNING 

Control Enhancement:

The organization employs vulnerability scanning procedures that can demonstrate the breadth 

and depth of scan coverage, including vulnerabilities checked and information system 

components scanned.

RA-5(3).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization implements procedures that can demonstrate the breadth of scan 

coverage (including information system components scanned); and 

(ii) the organization implements procedures that can demonstrate the depth of scan 

coverage (including vulnerabilities checked). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk 

assessment; list of vulnerabilities scanned and information system components checked; 

other relevant documents or records]. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-1 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, system and services acquisition policy that includes information 

security considerations and that addresses purpose, scope, roles, responsibilities, 

management commitment, coordination among organizational entities, and compliance; 

and (ii) formal, documented procedures to facilitate the implementation of the system and 

services acquisition policy and associated system and services acquisition controls. 

Supplemental Guidance: The system and services acquisition policy and procedures are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The system and services acquisition policy can be included as 

part of the general information security policy for the organization. System and services 

acquisition procedures can be developed for the security program in general, and for a 

particular information system, when required. NIST Special Publication 800-12 provides 

guidance on security policies and procedures. 

SA-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents system and services acquisition policy and 

procedures; 

(ii) the organization disseminates system and services acquisition policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review system and services 

acquisition policy and procedures; and 

(iv) the organization updates system and services acquisition policy and procedures 

when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and services acquisition 

responsibilities]. (H)

SA-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the system and services acquisition policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the system and services acquisition policy is consistent with the organization’s 

mission and functions and with applicable laws, directives, policies, regulations, 

standards, and guidance; and 

(iii) the system and services acquisition procedures address all areas identified in the 

system and services acquisition policy and address achieving policy-compliant 

implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and services acquisition 

responsibilities]. (H)

APPENDIX F - SA PAGE F-212 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-2 ALLOCATION OF RESOURCES 

Control: The organization determines, documents, and allocates as part of its capital 

planning and investment control process, the resources required to adequately protect the 

information system. 

Supplemental Guidance: The organization includes the determination of security 

requirements for the information system in mission/business case planning and 

establishes a discrete line item for information system security in the organization’s 

programming and budgeting documentation. NIST Special Publication 800-65 provides 

guidance on integrating security into the capital planning and investment control process. 

SA-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization determines, documents, and allocates as part of its capital 

planning and investment control process, the resources required to adequately 

protect the information system; 

(ii) the organization determines security requirements for the information system in 

mission/business case planning; 

(iii) the organization establishes a discrete line item for information system security in 

the organization’s programming and budgeting documentation; and 

(iv) the organization’s programming and budgeting process is consistent with NIST 

Special Publication 800-65. 

ASSESSMENT METHODS AND OBJECTS: 

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the 

allocation of resources to information security requirements; NIST Special Publication 800-

65; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with capital planning and investment 

responsibilities]. (H)

APPENDIX F - SA PAGE F-213 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-3 LIFE CYCLE SUPPORT 

Control: The organization manages the information system using a system development 

life cycle methodology that includes information security considerations. 

Supplemental Guidance: NIST Special Publication 800-64 provides guidance on security 

considerations in the system development life cycle. 

SA-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization manages the information system using a system development life 

cycle methodology that includes information security considerations; and 

(ii) the organization uses a system development life cycle that is consistent with NIST 

Special Publication 800-64. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the 

integration of information security into the system development life cycle process; NIST 

Special Publication 800-64; information system development life cycle documentation; 

other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information security and system life cycle 

development responsibilities]. (H)

APPENDIX F - SA PAGE F-214 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-4 ACQUISITIONS 

Control: The organization includes security requirements and/or security specifications, 

either explicitly or by reference, in information system acquisition contracts based on an 

assessment of risk and in accordance with applicable laws, Executive Orders, directives, 

policies, regulations, and standards. 

Supplemental Guidance: 

Solicitation Documents 

The solicitation documents (e.g., Requests for Proposals) for information systems and 

services include, either explicitly or by reference, security requirements that describe: (i) 

required security capabilities (security needs and, as necessary, specific security controls 

and other specific FISMA requirements); (ii) required design and development processes; 

(iii) required test and evaluation procedures; and (iv) required documentation. The 

requirements in the solicitation documents permit updating security controls as new 

threats/vulnerabilities are identified and as new technologies are implemented. NIST 

Special Publication 800-36 provides guidance on the selection of information security 

products. NIST Special Publication 800-35 provides guidance on information technology 

security services. NIST Special Publication 800-64 provides guidance on security 

considerations in the system development life cycle. 

Information System Documentation 

The solicitation documents include requirements for appropriate information system 

documentation. The documentation addresses user and systems administrator guidance 

and information regarding the implementation of the security controls in the information 

system. The level of detail required in the documentation is based on the FIPS 199 

security category for the information system. 

Use of Tested, Evaluated, and Validated Products

NIST Special Publication 800-23 provides guidance on the acquisition and use of 

tested/evaluated information technology products. 

Configuration Settings and Implementation Guidance 

The information system required documentation includes security configuration settings 

and security implementation guidance. OMB FISMA reporting instructions provide 

guidance on configuration requirements for federal information systems. NIST Special 

Publication 800-70 provides guidance on configuration settings for information 

technology products. 

APPENDIX F - SA PAGE F-215 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

SA-4.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization includes security requirements and/or security specifications, 

either explicitly or by reference, in information system acquisition contracts based 

on an assessment of risk and in accordance with applicable laws, Executive Orders, 

directives, policies, regulations, and standards; 

(ii) the organization’s acquisition of commercial information technology products is 

consistent with NIST Special Publication 800-23; 

(iii) references to security configuration settings and security implementation guidance 

in organizational acquisitions are consistent with NIST Special Publication 800-70; 

and 

(iv) acquisition contracts for information systems include, either explicitly or by 

reference, security requirements and/or security specifications that describe: 

- required security capabilities; 

- required design and development processes; 

- required test and evaluation procedures; and 

- required documentation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the 

integration of information security requirements and/or security specifications into the 

acquisition process; NIST Special Publications 800-23 and 800-70; acquisition 

documentation; acquisition contracts for information systems or services; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and 

contracting responsibilities]. (H)

APPENDIX F - SA PAGE F-216 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-4(1) ACQUISITIONS 

Control Enhancement:

The organization requires in solicitation documents that appropriate documentation be 

provided describing the functional properties of the security controls employed within the 

information system with sufficient detail to permit analysis and testing of the controls. 

SA-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization requires in solicitation documents that appropriate 

documentation be provided describing the functional properties of the security controls 

employed within the information system with sufficient detail to permit analysis and 

testing of the controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the 

integration of information security requirements and/or security specifications into the 

acquisition process; solicitation documents; acquisition documentation; acquisition 

contracts for information systems or services; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and 

contracting responsibilities]. (M) (H)

SA-4(2) ACQUISITIONS 

Control Enhancement:

The organization requires in solicitation documents that appropriate documentation be 

provided describing the design and implementation details of the security controls employed 

within the information system with sufficient detail to permit analysis and testing of the 

controls (including functional interfaces among control components). 

SA-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization requires in solicitation documents that appropriate 

documentation be provided describing the design and implementation details of the 

security controls employed within the information system with sufficient detail to permit 

analysis and testing of the controls (including functional interfaces among control 

components). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the 

integration of information security requirements and/or security specifications into the 

acquisition process; solicitation documents; acquisition documentation; acquisition 

contracts for information systems or services; other relevant documents or records]. 

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and 

contracting responsibilities].

APPENDIX F - SA PAGE F-217 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-5 INFORMATION SYSTEM DOCUMENTATION 

Control: The organization obtains, protects as required, and makes available to authorized 

personnel, adequate documentation for the information system. 

Supplemental Guidance: Documentation includes administrator and user guides with 

information on: (i) configuring, installing, and operating the information system; and (ii) 

effectively using the system’s security features. When adequate information system 

documentation is either unavailable or non existent (e.g., due to the age of the system or 

lack of support from the vendor/manufacturer), the organization documents attempts to 

obtain such documentation and provides compensating security controls, if needed. 

SA-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization obtains, protects as required, and makes available to authorized 

personnel, adequate documentation for the information system; 

(ii) the organization makes available information on configuring, installing, and 

operating the information system; and 

(iii) the organization makes available information on effectively using the security 

features in the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information 

system documentation; information system documentation including administrator and user 

guides; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system documentation 

responsibilities; organizational personnel operating, using, and/or maintaining the 

information system]. (H)

APPENDIX F - SA PAGE F-218 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-5(1) INFORMATION SYSTEM DOCUMENTATION 

Control Enhancement:

The organization includes, in addition to administrator and user guides, documentation, if 

available from the vendor/manufacturer, describing the functional properties of the security 

controls employed within the information system with sufficient detail to permit analysis and 

testing of the controls. 

SA-5(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization includes, in addition to administrator and user guides, 

documentation, if available from the vendor/manufacturer, describing the functional 

properties of the security controls employed within the information system with sufficient 

detail to permit analysis and testing of the controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information 

system documentation; information system design documentation; other relevant 

documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system security, acquisition, and 

contracting responsibilities; organizational personnel operating, using, and/or maintaining 

the information system]. (M) (H)

SA-5(2) INFORMATION SYSTEM DOCUMENTATION 

Control Enhancement:

The organization includes, in addition to administrator and user guides, documentation, if 

available from the vendor/manufacturer, describing the design and implementation details of 

the security controls employed within the information system with sufficient detail to permit 

analysis and testing of the controls (including functional interfaces among control 

components). 

SA-5(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization includes, in addition to administrator and user guides, 

documentation, if available from the vendor/manufacturer, describing the design and 

implementation details of the security controls employed within the information system 

with sufficient detail to permit analysis and testing of the controls (including functional 

interfaces among control components). 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information 

system documentation; information system design documentation; other relevant 

documents or records]. (H)

Interview: [SELECT FROM: Organizational personnel with information system security documentation 

responsibilities; organizational personnel operating, using, and/or maintaining the 

information system]. (H)

APPENDIX F - SA PAGE F-219 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-6 SOFTWARE USAGE RESTRICTIONS 

Control: The organization complies with software usage restrictions. 

Supplemental Guidance: Software and associated documentation are used in accordance 

with contract agreements and copyright laws. For software and associated documentation 

protected by quantity licenses, the organization employs tracking systems to control 

copying and distribution. The organization controls and documents the use of publicly 

accessible peer-to-peer file sharing technology to ensure that this capability is not used 

for the unauthorized distribution, display, performance, or reproduction of copyrighted 

work. 

SA-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization complies with software usage restrictions; and 

(ii) the organization regularly reviews/analyzes software usage for indications of 

inappropriate or unusual activity, investigates suspicious activity or suspected 

violations, reports findings to appropriate officials, and takes necessary actions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing software 

usage restrictions; site license documentation; list of software usage restrictions; other 

relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system administration 

responsibilities; organizational personnel operating, using, and/or maintaining the 

information system]. (H)

APPENDIX F - SA PAGE F-220 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-7 USER INSTALLED SOFTWARE 

Control: The organization enforces explicit rules governing the installation of software by 

users. 

Supplemental Guidance: If provided the necessary privileges, users have the ability to 

install software. The organization identifies what types of software installations are 

permitted (e.g., updates and security patches to existing software) and what types of 

installations are prohibited (e.g., software that is free only for personal, not government 

use, and software whose pedigree with regard to being potentially malicious is unknown 

or suspect). 

SA-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization enforces explicit rules governing the installation of software by 

users; 

(ii) unauthorized software is present on the system; and 

(iii) the organization regularly reviews/analyzes user installed software for indications 

of inappropriate or unusual activity, investigates suspicious activity or suspected 

violations, reports findings to appropriate officials, and takes necessary action. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing user 

installed software; list of rules governing user installed software; network traffic on the 

information system; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system administration 

responsibilities; organizational personnel operating, using, and/or maintaining the 

information system]. (M) (H)

Test: [SELECT FROM: Enforcement of rules for user installed software on the information system; 

information system for prohibited software]. (H)

APPENDIX F - SA PAGE F-221 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-8 SECURITY ENGINEERING PRINCIPLES 

Control: The organization designs and implements the information system using security 

engineering principles. 

Supplemental Guidance: NIST Special Publication 800-27 provides guidance on 

engineering principles for information system security. The application of security 

engineering principles is primarily targeted at new development information systems or 

systems undergoing major upgrades and is integrated into the system development life 

cycle. For legacy information systems, the organization applies security engineering 

principles to system upgrades and modifications, to the extent feasible, given the current 

state of the hardware, software, and firmware components within the system. 

SA-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization designs and implements the information system using security 

engineering principles; and 

(ii) the organization considers security design principles in the development and 

implementation of the information system consistent with NIST Special Publication 

800-27. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing security 

engineering principles used in the development and implementation of the information 

system; NIST Special Publication 800-27; information system design documentation; 

security requirements and security specifications for the information system; other relevant 

documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and services acquisition 

responsibilities]. (H)

APPENDIX F - SA PAGE F-222 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-9 EXTERNAL INFORMATION SYSTEM SERVICES 

Control: The organization: (i) requires that providers of external information system 

services employ adequate security controls in accordance with applicable laws, Executive 

Orders, directives, policies, regulations, standards, guidance, and established service-level 

agreements; and (ii) monitors security control compliance. 

Supplemental Guidance: An external information system service is a service that is 

implemented outside of the accreditation boundary of the organizational information 

system (i.e., a service that is used by, but not a part of, the organizational information 

system). Relationships with external service providers are established in a variety of 

ways, for example, through joint ventures, business partnerships, outsourcing 

arrangements (i.e., through contracts, interagency agreements, lines of business 

arrangements), licensing agreements, and/or supply chain exchanges. Ultimately, the 

responsibility for adequately mitigating risks to the organization’s operations and assets, 

and to individuals, arising from the use of external information system services remains 

with the authorizing official. Authorizing officials must require that an appropriate chain 

of trust be established with external service providers when dealing with the many issues 

associated with information system security. For services external to the organization, a 

chain of trust requires that the organization establish and retain a level of confidence that 

each participating service provider in the potentially complex consumer-provider 

relationship provides adequate protection for the services rendered to the organization. 

Where a sufficient level of trust cannot be established in the external services and/or 

service providers, the organization employs compensating security controls or accepts the 

greater degree of risk to its operations and assets, or to individuals. The external 

information system services documentation includes government, service provider, and 

end user security roles and responsibilities, and any service-level agreements. Servicelevel agreements define the expectations of performance for each required security 

control, describe measurable outcomes, and identify remedies and response requirements 

for any identified instance of non-compliance. NIST Special Publication 800-35 provides 

guidance on information technology security services. NIST Special Publication 800-64 

provides guidance on the security considerations in the system development life cycle. 

APPENDIX F - SA PAGE F-223 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

ASSESSMENT PROCEDURE

SA-9.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization requires that providers of external information system services 

employ adequate security controls in accordance with applicable laws, Executive 

Orders, directives, policies, regulations, standards, guidance, and established 

service-level agreements; 

(ii) the organization monitors security control compliance; 

(iii) the organization regularly reviews/analyzes outsourced information system services 

for indications of inappropriate or unusual activity, investigates suspicious activity 

or suspected violations, reports findings to appropriate officials, and takes 

necessary actions; and 

(iv) the security controls employed by providers of external information system services 

are compliant with applicable federal laws, directives, policies, regulations, 

standards, guidance, and established service level agreements. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing external 

information system services; acquisition contracts and service level agreements; 

organizational security requirements and security specifications for external provider 

services; security control assessment evidence from external providers of information 

system services; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and services acquisition 

responsibilities; external providers of information system services]. (H)

APPENDIX F - SA PAGE F-224 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-10 DEVELOPER CONFIGURATION MANAGEMENT 

Control: The organization requires that information system developers create and 

implement a configuration management plan that controls changes to the system during 

development, tracks security flaws, requires authorization of changes, and provides 

documentation of the plan and its implementation. 

Supplemental Guidance: This control also applies to the development actions associated 

with information system changes. 

SA-10.1 ASSESSMENT OBJECTIVE:

Determine if the organization requires that information system developers (and systems 

integrators) create and implement a configuration management plan that controls 

changes to the system during development, tracks security flaws, requires authorization 

of changes, and provides documentation of the plan and its implementation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information 

system developer/integrator configuration management; acquisition contracts and service 

level agreements; information system developer/integrator configuration management plan; 

security flaw tracking records; system change authorization records; other relevant 

documents or records]. (H)

APPENDIX F - SA PAGE F-225 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - SA PAGE F-226 

FAMILY: SYSTEM AND SERVICES ACQUISITION CLASS: MANAGEMENT 

ASSESSMENT PROCEDURE

SA-11 DEVELOPER SECURITY TESTING 

Control: The organization requires that information system developers create a security 

test and evaluation plan, implement the plan, and document the results.

Supplemental Guidance: Developmental security test results are used to the greatest extent 

feasible after verification of the results and recognizing that these results are impacted 

whenever there have been security relevant modifications to the information system 

subsequent to developer testing. Test results may be used in support of the security 

certification and accreditation process for the delivered information system. Related 

security controls: CA-2, CA-4. 

SA-11.1 ASSESSMENT OBJECTIVE:

Determine if the organization requires that information system developers (and systems 

integrators) create a security test and evaluation plan, implement the plan, and document 

the results. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing information 

system developer/integrator security testing; acquisition contracts and service level 

agreements; information system developer/integrator security test plans; records of 

developer/integrator security testing results for the information system; other relevant 

documents or records]. (M) (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-1 SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, system and communications protection policy that addresses 

purpose, scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the system and communications protection policy and 

associated system and communications protection controls. 

Supplemental Guidance: The system and communications protection policy and procedures 

are consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The system and communications protection policy can be 

included as part of the general information security policy for the organization. System 

and communications protection procedures can be developed for the security program in 

general, and for a particular information system, when required. NIST Special 

Publication 800-12 provides guidance on security policies and procedures. 

SC-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents system and communications protection 

policy and procedures; 

(ii) the organization disseminates system and communications protection policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review system and 

communications protection policy and procedures; and 

(iv) the organization updates system and communications protection policy and 

procedures when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy and procedures; other 

relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and communications protection 

responsibilities]. (H)

SC-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the system and communications protection policy addresses purpose, scope, roles 

and responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the system and communications protection policy is consistent with the 

organization’s mission and functions and with applicable laws, directives, policies, 

regulations, standards, and guidance; and 

(iii) the system and communications protection procedures address all areas identified 

in the system and communications protection policy and address achieving policycompliant implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy and procedures; other 

relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and communications protection 

responsibilities]. (H)

APPENDIX F - SC PAGE F-227 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-2 APPLICATION PARTITIONING

Control: The information system separates user functionality (including user interface 

services) from information system management functionality. 

Supplemental Guidance: The information system physically or logically separates user 

interface services (e.g., public web pages) from information storage and management 

services (e.g., database management). Separation may be accomplished through the use 

of different computers, different central processing units, different instances of the 

operating system, different network addresses, combinations of these methods, or other 

methods as appropriate. 

SC-2.1 ASSESSMENT OBJECTIVE:

Determine if the information system separates user functionality (including user interface 

services) from information system management functionality. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

application partitioning; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Separation of user functionality from information system management 

functionality]. (H)

APPENDIX F - SC PAGE F-228 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-3 SECURITY FUNCTION ISOLATION

Control: The information system isolates security functions from nonsecurity functions. 

Supplemental Guidance: The information system isolates security functions from 

nonsecurity functions by means of partitions, domains, etc., including control of access to 

and integrity of, the hardware, software, and firmware that perform those security 

functions. The information system maintains a separate execution domain (e.g., address 

space) for each executing process. 

SC-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the security functions of the information system to be 

isolated from nonsecurity functions; and 

(ii) the information system isolates security functions from nonsecurity functions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; list of security functions to be isolated from nonsecurity 

functions; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Separation of security functions from nonsecurity functions within the information 

system]. (H)

APPENDIX F - SC PAGE F-229 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-3(1) SECURITY FUNCTION ISOLATION

Control Enhancement:

The information system employs underlying hardware separation mechanisms to facilitate 

security function isolation. 

SC-3(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs underlying hardware separation 

mechanisms to facilitate security function isolation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; information system design documentation; hardware separation 

mechanisms; information system configuration settings and associated documentation; 

other relevant documents or records]. 

Test: [SELECT FROM: Hardware separation mechanisms facilitating security function isolation]. 

SC-3(2) SECURITY FUNCTION ISOLATION

Control Enhancement:

The information system isolates critical security functions (i.e., functions enforcing access 

and information flow control) from both nonsecurity functions and from other security 

functions. 

SC-3(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the critical security functions of the information system to 

be isolated from both nonsecurity functions and from other security functions; and 

(ii) the information system isolates critical security functions from both nonsecurity 

functions and from other security functions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; list of critical security functions; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. 

Test: [SELECT FROM: Isolation of critical security functions]. 

APPENDIX F - SC PAGE F-230 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-3(3) SECURITY FUNCTION ISOLATION

Control Enhancement:

The information system minimizes the number of nonsecurity functions included within the 

isolation boundary containing security functions. 

SC-3(3).1 ASSESSMENT OBJECTIVE:

Determine if the information system minimizes the number of nonsecurity functions 

included within the isolation boundary containing security functions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

SC-3(4) SECURITY FUNCTION ISOLATION

Control Enhancement:

The information system security functions are implemented as largely independent modules 

that avoid unnecessary interactions between modules.

SC-3(4).1 ASSESSMENT OBJECTIVE:

Determine if the information system security functions are implemented as largely 

independent modules that avoid unnecessary interactions between modules. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

APPENDIX F - SC PAGE F-231 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-3(5) SECURITY FUNCTION ISOLATION

Control Enhancement:

The information system security functions are implemented as a layered structure minimizing 

interactions between layers of the design and avoiding any dependence by lower layers on the 

functionality or correctness of higher layers. 

SC-3(5).1 ASSESSMENT OBJECTIVE:

Determine if the information system security functions are implemented as a layered 

structure minimizing interactions between layers of the design and avoiding any 

dependence by lower layers on the functionality or correctness of higher layers. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

security function isolation; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

APPENDIX F - SC PAGE F-232 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-4 INFORMATION REMNANCE

Control: The information system prevents unauthorized and unintended information 

transfer via shared system resources. 

Supplemental Guidance: Control of information system remnance, sometimes referred to as 

object reuse, or data remnance, prevents information, including encrypted representations 

of information, produced by the actions of a prior user/role (or the actions of a process 

acting on behalf of a prior user/role) from being available to any current user/role (or 

current process) that obtains access to a shared system resource (e.g., registers, main 

memory, secondary storage) after that resource has been released back to the information 

system. 

SC-4.1 ASSESSMENT OBJECTIVE:

Determine if the information system prevents unauthorized and unintended information 

transfer via shared system resources. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

information remnance; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Information system for unauthorized and unintended transfer of information via 

shared system resources]. (H)

APPENDIX F - SC PAGE F-233 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-5 DENIAL OF SERVICE PROTECTION

Control: The information system protects against or limits the effects of the following 

types of denial of service attacks: [Assignment: organization-defined list of types of 

denial of service attacks or reference to source for current list]. 

Supplemental Guidance: A variety of technologies exist to limit, or in some cases, eliminate 

the effects of denial of service attacks. For example, boundary protection devices can 

filter certain types of packets to protect devices on an organization’s internal network 

from being directly affected by denial of service attacks. Information systems that are 

publicly accessible can be protected by employing increased capacity and bandwidth 

combined with service redundancy. 

SC-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the types of denial of service attacks (or provides 

references to sources of current denial of service attacks) that can be addressed by 

the information system; and 

(ii) the information system protects against or limits the effects of the organizationdefined or referenced types of denial of service attacks. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

denial of service protection; information system design documentation; information system 

security plan; information system configuration settings and associated documentation; 

other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Information system for protection against or limitation of the effects of denial of 

service attacks]. (H)

APPENDIX F - SC PAGE F-234 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-5(1) DENIAL OF SERVICE PROTECTION

Control Enhancement:

The information system restricts the ability of users to launch denial of service attacks against 

other information systems or networks. 

SC-5(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system restricts the ability of users to launch denial of 

service attacks against other information systems or networks. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

denial of service protection; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

Test: [SELECT FROM: Information system for protection against or limitation of the effects of denial of 

service attacks].

SC-5(2) DENIAL OF SERVICE PROTECTION

Control Enhancement:

The information system manages excess capacity, bandwidth, or other redundancy to limit the 

effects of information flooding types of denial of service attacks. 

SC-5(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system manages excess capacity, bandwidth, or other 

redundancy to limit the effects of information flooding types of denial of service attacks. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

denial of service protection; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

APPENDIX F - SC PAGE F-235 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-6 RESOURCE PRIORITY

Control: The information system limits the use of resources by priority. 

Supplemental Guidance: Priority protection helps prevent a lower-priority process from 

delaying or interfering with the information system servicing any higher-priority process. 

SC-6.1 ASSESSMENT OBJECTIVE:

Determine if the information system limits the use of resources by priority. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

prioritization of information system resources; information system design documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. 

APPENDIX F - SC PAGE F-236 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-7 BOUNDARY PROTECTION

Control: The information system monitors and controls communications at the external 

boundary of the information system and at key internal boundaries within the system.

Supplemental Guidance: Any connections to the Internet, or other external networks or 

information systems, occur through managed interfaces consisting of appropriate 

boundary protection devices (e.g., proxies, gateways, routers, firewalls, guards, encrypted 

tunnels) arranged in an effective architecture (e.g., routers protecting firewalls and 

application gateways residing on a protected subnetwork commonly referred to as a 

demilitarized zone or DMZ). Information system boundary protections at any designated 

alternate processing sites provide the same levels of protection as that of the primary site. 

As part of a defense-in-depth protection strategy, the organization considers partitioning 

higher-impact information systems into separate physical domains (or environments) and 

applying the concepts of managed interfaces described above to restrict or prohibit 

network access in accordance with an organizational assessment of risk. FIPS 199 

security categorization guides the selection of appropriate candidates for domain 

partitioning. 

The organization carefully considers the intrinsically shared nature of commercial 

telecommunications services in the implementation of security controls associated with 

the use of such services. Commercial telecommunications services are commonly based 

on network components and consolidated management systems shared by all attached 

commercial customers, and may include third party provided access lines and other 

service elements. Consequently, such interconnecting transmission services may 

represent sources of increased risk despite contract security provisions. Therefore, when 

this situation occurs, the organization either implements appropriate compensating 

security controls or explicitly accepts the additional risk. NIST Special Publication 800-

77 provides guidance on virtual private networks. Related security controls: MP-4, RA-2. 

SC-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines key internal boundaries of the information system; and 

(ii) the information system monitors and controls communications at the external 

boundary of the information system and at key internal boundaries within the 

system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; list of key internal boundaries of the information system; information 

system design documentation; boundary protection hardware and software; information 

system configuration settings and associated documentation; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection 

responsibilities]. (M) (H)

Test: [SELECT FROM: Information system monitoring and control of communications at the external 

boundary of the information system and at key internal boundaries within the system; 

automated mechanisms implementing boundary protection capability within the information 

system]. (H)

APPENDIX F - SC PAGE F-237 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-7(1) BOUNDARY PROTECTION

Control Enhancement:

The organization physically allocates publicly accessible information system components to 

separate subnetworks with separate, physical network interfaces. 

Enhancement Supplemental Guidance: Publicly accessible information system components 

include, for example, public web servers. 

SC-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization physically allocates publicly accessible information system 

components to separate subnetworks with separate, physical network interfaces. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

hardware and software; information system architecture; information system configuration 

settings and associated documentation; other relevant documents or records]. (M) (H)

SC-7(2) BOUNDARY PROTECTION

Control Enhancement:

The organization prevents public access into the organization’s internal networks except as 

appropriately mediated. 

SC-7(2).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the mediation necessary for public access to the 

organization’s internal networks; and 

(ii) the organization prevents public access into the organization’s internal networks 

except as appropriately mediated. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; list of mediation vehicles for allowing public access to the 

organization’s internal networks; information system design documentation; boundary 

protection hardware and software; information system configuration settings and 

associated documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access controls for public access to the 

organization’s internal networks]. (H)

APPENDIX F - SC PAGE F-238 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-7(3) BOUNDARY PROTECTION

Control Enhancement:

The organization limits the number of access points to the information system to allow for 

better monitoring of inbound and outbound network traffic. 

SC-7(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization limits the number of access points to the information system 

to allow for better monitoring of inbound and outbound network traffic. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; boundary protection 

hardware and software; information system architecture and configuration documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

SC-7(4) BOUNDARY PROTECTION

Control Enhancement:

The organization implements a managed interface (boundary protection devices in an effective 

security architecture) with any external telecommunication service, implementing controls 

appropriate to the required protection of the confidentiality and integrity of the information 

being transmitted. 

SC-7(4).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the security controls (i.e., boundary protection devices and 

architectural configuration of the devices) appropriate at each external interface to 

a telecommunication service; and 

(ii) the organization implements a managed interface with any external 

telecommunication service, implementing controls appropriate to the required 

protection of the confidentiality and integrity of the information being transmitted. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system security architecture; information system design 

documentation; boundary protection hardware and software; information system 

architecture and configuration documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection 

responsibilities]. (H)

APPENDIX F - SC PAGE F-239 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-7(5) BOUNDARY PROTECTION

Control Enhancement:

The information system denies network traffic by default and allows network traffic by 

exception (i.e., deny all, permit by exception). 

SC-7(5).1 ASSESSMENT OBJECTIVE:

Determine if the information system denies network traffic by default and allows network 

traffic by exception. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection 

responsibilities]. (H)

SC-7(6) BOUNDARY PROTECTION

Control Enhancement:

The organization prevents the unauthorized release of information outside of the information 

system boundary or any unauthorized communication through the information system 

boundary when there is an operational failure of the boundary protection mechanisms. 

SC-7(6).1 ASSESSMENT OBJECTIVE:

Determine if the organization prevents the unauthorized release of information outside of 

the information system boundary or any unauthorized communication through the 

information system boundary when there is an operational failure of the boundary 

protection mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

configuration settings and associated documentation; information system audit records; 

other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms supporting the fail-safe boundary protection capability 

within the information system]. (H)

APPENDIX F - SC PAGE F-240 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-8 TRANSMISSION INTEGRITY

Control: The information system protects the integrity of transmitted information. 

Supplemental Guidance: If the organization is relying on a commercial service provider for 

transmission services as a commodity item rather than a fully dedicated service, it may be 

more difficult to obtain the necessary assurances regarding the implementation of needed 

security controls for transmission integrity. When it is infeasible or impractical to obtain 

the necessary security controls and assurances of control effectiveness through 

appropriate contracting vehicles, the organization either implements appropriate 

compensating security controls or explicitly accepts the additional risk. NIST Special 

Publication 800-52 provides guidance on protecting transmission integrity using 

Transport Layer Security (TLS). NIST Special Publication 800-77 provides guidance on 

protecting transmission integrity using IPsec. NIST Special Publication 800-81 provides 

guidance on Domain Name System (DNS) message authentication and integrity 

verification. NSTISSI No. 7003 contains guidance on the use of Protective Distribution 

Systems. 

SC-8.1 ASSESSMENT OBJECTIVE:

Determine if the information system protects the integrity of transmitted information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

transmission integrity; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Transmission integrity capability within the information system]. (H)

APPENDIX F - SC PAGE F-241 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-8(1) TRANSMISSION INTEGRITY

Control Enhancement:

The organization employs cryptographic mechanisms to recognize changes to information 

during transmission unless otherwise protected by alternative physical measures. 

Enhancement Supplemental Guidance: Alternative physical protection measures include, for 

example, protected distribution systems.

SC-8(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs cryptographic mechanisms to recognize 

changes to information during transmission unless otherwise protected by alternative 

physical measures 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

transmission integrity; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (H)

Test: [SELECT FROM: Cryptographic mechanisms implementing transmission integrity capability within 

the information system]. (H)

APPENDIX F - SC PAGE F-242 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-9 TRANSMISSION CONFIDENTIALITY

Control: The information system protects the confidentiality of transmitted information. 

Supplemental Guidance: If the organization is relying on a commercial service provider for 

transmission services as a commodity item rather than a fully dedicated service, it may be 

more difficult to obtain the necessary assurances regarding the implementation of needed 

security controls for transmission confidentiality. When it is infeasible or impractical to 

obtain the necessary security controls and assurances of control effectiveness through 

appropriate contracting vehicles, the organization either implements appropriate 

compensating security controls or explicitly accepts the additional risk. NIST Special 

Publication 800-52 provides guidance on protecting transmission confidentiality using 

Transport Layer Security (TLS). NIST Special Publication 800-77 provides guidance on 

protecting transmission confidentiality using IPsec. NSTISSI No. 7003 contains 

guidance on the use of Protective Distribution Systems. Related security control: AC-17. 

SC-9.1 ASSESSMENT OBJECTIVE:

Determine if the information system protects the confidentiality of transmitted 

information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

transmission confidentiality; information system design documentation; contracts for 

telecommunications services; information system configuration settings and associated 

documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Transmission confidentiality capability within the information system]. (H)

APPENDIX F - SC PAGE F-243 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-9(1) TRANSMISSION CONFIDENTIALITY

Control Enhancement:

The organization employs cryptographic mechanisms to prevent unauthorized disclosure of 

information during transmission unless otherwise protected by alternative physical measures. 

Enhancement Supplemental Guidance: Alternative physical protection measures include, for 

example, protected distribution systems.

SC-9(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs cryptographic mechanisms to prevent 

unauthorized disclosure of information during transmission unless otherwise protected by 

alternative physical measure. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

transmission confidentiality; information system design documentation; information system 

communications hardware and software or Protected Distribution System protection 

mechanisms; information system configuration settings and associated documentation; 

other relevant documents or records]. (H)

Test: [SELECT FROM: Cryptographic mechanisms implementing transmission confidentiality capability 

within the information system]. (H)

APPENDIX F - SC PAGE F-244 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-10 NETWORK DISCONNECT

Control: The information system terminates a network connection at the end of a session 

or after [Assignment: organization-defined time period] of inactivity.

Supplemental Guidance: The organization applies this control within the context of risk 

management that considers specific mission or operational requirements. 

SC-10.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the time period of inactivity before the information system 

terminates a network connection; and 

(ii) the information system terminates a network connection at the end of a session or 

after the organization-defined time period of inactivity. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

network disconnect; information system design documentation; organization-defined time 

period of inactivity before network disconnect; information system configuration settings 

and associated documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Network disconnect capability within the information system]. (M) (H)

APPENDIX F - SC PAGE F-245 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-11 TRUSTED PATH

Control: The information system establishes a trusted communications path between the 

user and the following security functions of the system: [Assignment: organizationdefined security functions to include at a minimum, information system authentication 

and reauthentication]. 

Supplemental Guidance: A trusted path is employed for high-confidence connections 

between the security functions of the information system and the user (e.g., for login). 

SC-11.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the security functions within the information system that 

are included in a trusted communications path; 

(ii) the organization-defined security functions include information system 

authentication and reauthentication; and 

(iii) the information system establishes a trusted communications path between the user 

and the organization-defined security functions within the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

trusted communications paths; information system security plan; information system design 

documentation; information system configuration settings and associated documentation; 

assessment results from independent, testing organizations; other relevant documents or 

records].

Test: [SELECT FROM: Automated mechanisms implementing trusted communications paths within the 

information system].

APPENDIX F - SC PAGE F-246 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

Control: When cryptography is required and employed within the information system, the 

organization establishes and manages cryptographic keys using automated mechanisms 

with supporting procedures or manual procedures. 

Supplemental Guidance: NIST Special Publication 800-56 provides guidance on 

cryptographic key establishment. NIST Special Publication 800-57 provides guidance on 

cryptographic key management. 

SC-12.1 ASSESSMENT OBJECTIVE:

Determine if the organization establishes and manages cryptographic keys using 

automated mechanisms with supporting procedures or manual procedures, when 

cryptography is required and employed within the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

cryptographic key management and establishment; NIST Special Publications 800-56 and 

800-57; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with responsibilities for cryptographic key 

establishment or management]. (H)

Test: [SELECT FROM: Automated mechanisms implementing cryptographic key management and 

establishment within the information system]. (H)

APPENDIX F - SC PAGE F-247 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-13 USE OF CRYPTOGRAPHY

Control: For information requiring cryptographic protection, the information system 

implements cryptographic mechanisms that comply with applicable laws, Executive 

Orders, directives, policies, regulations, standards, and guidance. 

Supplemental Guidance: The applicable federal standard for employing cryptography in 

nonnational security information systems is FIPS 140-2 (as amended). Validation 

certificates issued by the NIST Cryptographic Module Validation Program (including 

FIPS 140-1, FIPS 140-2, and future amendments) remain in effect and the modules 

remain available for continued use and purchase until a validation certificate is 

specifically revoked. NIST Special Publications 800-56 and 800-57 provide guidance on 

cryptographic key establishment and cryptographic key management. Additional 

information on the use of validated cryptography is available at 

http://csrc.nist.gov/cryptval. 

SC-13.1 ASSESSMENT OBJECTIVE:

Determine if, for information requiring cryptographic protection, the information system 

implements cryptographic mechanisms that comply with applicable laws, Executive 

Orders, directives, policies, regulations, standards, and guidance. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing use 

of cryptography; FIPS 140-2 (as amended); NIST Special Publications 800-56 and 800-57; 

information system design documentation; information system configuration settings and 

associated documentation; cryptographic module validation certificates; other relevant 

documents or records]. (L) (M) (H)

APPENDIX F - SC PAGE F-248 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-14 PUBLIC ACCESS PROTECTIONS

Control: The information system protects the integrity and availability of publicly 

available information and applications. 

Supplemental Guidance: None. 

SC-14.1 ASSESSMENT OBJECTIVE:

Determine if the information system protects the integrity and availability of publicly 

available information and applications. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

public access protections; access control policy and procedures; boundary protection 

procedures; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access controls and boundary protection 

for publicly available information and applications within the information system]. (H)

APPENDIX F - SC PAGE F-249 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-15 COLLABORATIVE COMPUTING

Control: The information system prohibits remote activation of collaborative computing 

mechanisms and provides an explicit indication of use to the local users. 

Supplemental Guidance: Collaborative computing mechanisms include, for example, video 

and audio conferencing capabilities. Explicit indication of use includes, for example, 

signals to local users when cameras and/or microphones are activated. 

SC-15.1 ASSESSMENT OBJECTIVE:

Determine if the information system prohibits remote activation of collaborative 

computing mechanisms and provides an explicit indication of use to the local users. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

collaborative computing; access control policy and procedures; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access controls for collaborative 

computing environments; alert notification for local users]. (H)

APPENDIX F - SC PAGE F-250 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-15(1) COLLABORATIVE COMPUTING

Control Enhancement:

The information system provides physical disconnect of camera and microphone in a manner 

that supports ease of use. 

SC-15(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides physical disconnect of camera and 

microphone in a manner that supports ease of use. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

collaborative computing; access control policy and procedures; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records].

Test: [SELECT FROM: Physical disconnect of collaborative computing devices].

APPENDIX F - SC PAGE F-251 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-16 TRANSMISSION OF SECURITY PARAMETERS

Control: The information system reliably associates security parameters with information 

exchanged between information systems. 

Supplemental Guidance: Security parameters include, for example, security labels and 

markings. Security parameters may be explicitly or implicitly associated with the 

information contained within the information system. 

SC-16.1 ASSESSMENT OBJECTIVE:

Determine if the information system reliably associates security parameters with 

information exchanged between information systems. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

transmission of security parameters; access control policy and procedures; boundary 

protection procedures; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records].

Test: [SELECT FROM: Automated mechanisms supporting reliable transmission of security parameters 

between information systems].

APPENDIX F - SC PAGE F-252 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES

Control: The organization issues public key certificates under an appropriate certificate 

policy or obtains public key certificates under an appropriate certificate policy from an 

approved service provider. 

Supplemental Guidance: For user certificates, each agency either establishes an agency 

certification authority cross-certified with the Federal Bridge Certification Authority at 

medium assurance or higher or uses certificates from an approved, shared service 

provider, as required by OMB Memorandum 05-24. NIST Special Publication 800-32 

provides guidance on public key technology. NIST Special Publication 800-63 provides 

guidance on remote electronic authentication. 

SC-17.1 ASSESSMENT OBJECTIVE:

Determine if the organization issues public key certificates under an appropriate 

certificate policy or obtains public key certificates under an appropriate certificate policy 

from an approved service provider. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

public key infrastructure certificates; public key certificate policy or policies; public key 

issuing process; NIST Special Publication 800-32; other relevant documents or records]. 

(M) (H)

Interview: [SELECT FROM: Organizational personnel with public key infrastructure certificate issuing 

responsibilities]. (H)

APPENDIX F - SC PAGE F-253 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-18 MOBILE CODE

Control: The organization: (i) establishes usage restrictions and implementation guidance 

for mobile code technologies based on the potential to cause damage to the information 

system if used maliciously; and (ii) authorizes, monitors, and controls the use of mobile 

code within the information system. 

Supplemental Guidance: Mobile code technologies include, for example, Java, JavaScript, 

ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. Usage 

restrictions and implementation guidance apply to both the selection and use of mobile 

code installed on organizational servers and mobile code downloaded and executed on 

individual workstations. Control procedures prevent the development, acquisition, or 

introduction of unacceptable mobile code within the information system. NIST Special 

Publication 800-28 provides guidance on active content and mobile code. 

SC-18.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes usage restrictions and implementation guidance for 

mobile code technologies based on the potential to cause damage to the information 

system if used maliciously; and 

(ii) the organization authorizes, monitors, and controls the use of mobile code within 

the information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

mobile code; mobile code usage restrictions, mobile code implementation guidance; NIST 

Special Publication 800-28; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with mobile code authorization, monitoring, and 

control responsibilities]. (H)

Test: [SELECT FROM: Mobile code authorization and monitoring capability for the organization]. (H)

APPENDIX F - SC PAGE F-254 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-19 VOICE OVER INTERNET PROTOCOL

Control: The organization: (i) establishes usage restrictions and implementation guidance 

for Voice over Internet Protocol (VoIP) technologies based on the potential to cause 

damage to the information system if used maliciously; and (ii) authorizes, monitors, and 

controls the use of VoIP within the information system.

Supplemental Guidance: NIST Special Publication 800-58 provides guidance on security 

considerations for VoIP technologies employed in information systems. 

SC-19.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization establishes usage restrictions and implementation guidance for 

Voice over Internet Protocol technologies based on the potential to cause damage to 

the information system if used maliciously; and 

(ii) the organization authorizes, monitors, and controls the use of VoIP within the 

information system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing VoIP; 

NIST Special Publication 800-58; VoIP usage restrictions; other relevant documents or 

records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with VoIP authorization and monitoring 

responsibilities]. (H)

APPENDIX F - SC PAGE F-255 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-20 SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE)

Control: The information system that provides name/address resolution service provides 

additional data origin and integrity artifacts along with the authoritative data it returns in 

response to resolution queries. 

Supplemental Guidance: This control enables remote clients to obtain origin authentication 

and integrity verification assurances for the name/address resolution information obtained 

through the service. A domain name system (DNS) server is an example of an 

information system that provides name/address resolution service; digital signatures and 

cryptographic keys are examples of additional artifacts; and DNS resource records are 

examples of authoritative data. NIST Special Publication 800-81 provides guidance on 

secure domain name system deployment. 

SC-20.1 ASSESSMENT OBJECTIVE:

Determine if the information system that provides the name/address lookup service for 

accessing organizational information resources to entities across the Internet provides 

artifacts for additional data origin authentication and data integrity artifacts along with 

the authoritative data it returns in response to resolution queries. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

secure name/address resolution service (authoritative source); NIST Special Publication 

800-81; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing secure name/address resolution service 

(authoritative source) within the information system]. (H)

APPENDIX F - SC PAGE F-256 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-20(1) SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE)

Control Enhancement:

The information system, when operating as part of a distributed, hierarchical namespace, 

provides the means to indicate the security status of child subspaces and (if the child 

supports secure resolution services) enable verification of a chain of trust among parent and 

child domains. 

Enhancement Supplemental Guidance: An example means to indicate the security status of 

child subspaces is through the use of delegation signer resource records.

SC-20(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system, when operating as part of a distributed, hierarchical 

namespace, provides the means to indicate the security status of child subspaces and (if 

the child supports secure resolution services) enable verification of a chain of trust 

among parent and child domains. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

secure name/address resolution service (authoritative source); information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. 

Test: [SELECT FROM: Automated mechanisms implementing child subspace security status indicators 

and chain of trust verification for resolution services within the information system].

APPENDIX F - SC PAGE F-257 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-21 SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) 

Control: The information system that provides name/address resolution service for local 

clients performs data origin authentication and data integrity verification on the resolution 

responses it receives from authoritative sources when requested by client systems. 

Supplemental Guidance: A resolving or caching domain name system (DNS) server is an 

example of an information system that provides name/address resolution service for local 

clients and authoritative DNS servers are examples of authoritative sources. NIST 

Special Publication 800-81 provides guidance on secure domain name system 

deployment.

SC-21.1 ASSESSMENT OBJECTIVE:

Determine if the information system that provides name/address resolution service for 

local clients performs data origin authentication and data integrity verification on the 

resolution responses it receives from authoritative sources when requested by client 

systems. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

secure name/address resolution service (recursive or caching resolver); information system 

design documentation; information system configuration settings and associated 

documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing data origin authentication and integrity 

verification for resolution services within the information system]. (H)

APPENDIX F - SC PAGE F-258 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-21(1) SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) 

Control Enhancement:

The information system performs data origin authentication and data integrity verification on 

all resolution responses whether or not local clients explicitly request this service. 

Enhancement Supplemental Guidance: Local clients include, for example, DNS stub 

resolvers.

SC-21(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system performs data origin authentication and data 

integrity verification on all resolution response received whether or not client systems 

explicitly request this service. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

secure name/address resolution service (recursive or caching resolver); NIST Special 

Publication 800-81; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. 

APPENDIX F - SC PAGE F-259 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS RESOLUTION SERVICE 

Control: The information systems that collectively provide name/address resolution 

service for an organization are fault tolerant and implement role separation. 

Supplemental Guidance: A domain name system (DNS) server is an example of an 

information system that provides name/address resolution service. To eliminate single 

points of failure and to enhance redundancy, there are typically at least two authoritative 

domain name system (DNS) servers, one configured as primary and the other as 

secondary. Additionally, the two servers are commonly located in two different network 

subnets and geographically separated (i.e., not located in the same physical facility). If 

organizational information technology resources are divided into those resources 

belonging to internal networks and those resources belonging to external networks, 

authoritative DNS servers with two roles (internal and external) are established. The 

DNS server with the internal role provides name/address resolution information 

pertaining to both internal and external information technology resources while the DNS 

server with the external role only provides name/address resolution information 

pertaining to external information technology resources. The list of clients who can 

access the authoritative DNS server of a particular role is also specified. NIST Special 

Publication 800-81 provides guidance on secure DNS deployment. 

SC-22.1 ASSESSMENT OBJECTIVE:

Determine if the information systems that collectively provide name/address resolution 

service for an organization are fault tolerant and implement role separation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

architecture and provisioning for name/address resolution service; access control policy 

and procedures; NIST Special Publication 800-81; information system design 

documentation; assessment results from independent, testing organizations; information 

system configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms supporting name/address resolution service for fault 

tolerance and role separation]. (H)

APPENDIX F - SC PAGE F-260 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - SC PAGE F-261 

FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION CLASS: TECHNICAL 

ASSESSMENT PROCEDURE

SC-23 SESSION AUTHENTICITY

Control: The information system provides mechanisms to protect the authenticity of 

communications sessions. 

Supplemental Guidance: This control focuses on communications protection at the session, 

versus packet, level. The intent of this control is to implement session-level protection 

where needed (e.g., in service-oriented architectures providing web-based services). 

NIST Special Publication 800-52 provides guidance on the use of transport layer security 

(TLS) mechanisms. NIST Special Publication 800-77 provides guidance on the 

deployment of IPsec virtual private networks (VPNs) and other methods of protecting 

communications sessions. NIST Special Publication 800-95 provides guidance on secure 

web services. 

SC-23.1 ASSESSMENT OBJECTIVE:

Determine if the information system provides mechanisms to protect the authenticity of 

communications sessions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

session authenticity; NIST Special Publications 800-52, 800-77, and 800-95; information 

system design documentation; information system configuration settings and associated 

documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing session authenticity]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

SI-1 SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES

Control: The organization develops, disseminates, and periodically reviews/updates: (i) a 

formal, documented, system and information integrity policy that addresses purpose, 

scope, roles, responsibilities, management commitment, coordination among 

organizational entities, and compliance; and (ii) formal, documented procedures to 

facilitate the implementation of the system and information integrity policy and 

associated system and information integrity controls. 

Supplemental Guidance: The system and information integrity policy and procedures are 

consistent with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and guidance. The system and information integrity policy can be included as 

part of the general information security policy for the organization. System and 

information integrity procedures can be developed for the security program in general, 

and for a particular information system, when required. NIST Special Publication 800-12 

provides guidance on security policies and procedures. 

SI-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents system and information integrity policy 

and procedures; 

(ii) the organization disseminates system and information integrity policy and 

procedures to appropriate elements within the organization; 

(iii) responsible parties within the organization periodically review system and 

information integrity policy and procedures; and 

(iv) the organization updates system and information integrity policy and procedures 

when organizational review indicates updates are required. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and information integrity 

responsibilities]. (H)

SI-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the system and information integrity policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; 

(ii) the system and information integrity policy is consistent with the organization’s 

mission and functions and with applicable laws, directives, policies, regulations, 

standards, and guidance; and 

(iii) the system and information integrity procedures address all areas identified in the 

system and information integrity policy and address achieving policy-compliant 

implementations of all associated security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy and procedures; other relevant 

documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with system and information integrity 

responsibilities]. (H)

APPENDIX F - SI PAGE F-262 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-2 FLAW REMEDIATION 

Control: The organization identifies, reports, and corrects information system flaws. 

Supplemental Guidance: The organization identifies information systems containing 

software affected by recently announced software flaws (and potential vulnerabilities 

resulting from those flaws). The organization (or the software developer/vendor in the 

case of software developed and maintained by a vendor/contractor) promptly installs 

newly released security relevant patches, service packs, and hot fixes, and tests patches, 

service packs, and hot fixes for effectiveness and potential side effects on the 

organization’s information systems before installation. Flaws discovered during security 

assessments, continuous monitoring, incident response activities, or information system 

error handling are also addressed expeditiously. Flaw remediation is incorporated into 

configuration management as an emergency change. NIST Special Publication 800-40, 

provides guidance on security patch installation and patch management. Related security 

controls: CA-2, CA-4, CA-7, CM-3, IR-4, SI-11. 

SI-2.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies, reports, and corrects information system flaws; 

(ii) the organization installs newly released security patches, service packs, and hot 

fixes on the information system in a reasonable timeframe in accordance with 

organizational policy and procedures; 

(iii) the organization addresses flaws discovered during security assessments, 

continuous monitoring, or incident response activities in an expeditious manner in 

accordance with organizational policy and procedures; 

(iv) the organization tests information system patches, service packs, and hot fixes for 

effectiveness and potential side effects before installation; and 

(v) the organization captures all appropriate information pertaining to the discovered 

flaws in the information system, including the cause of the flaws, mitigation 

activities, and lessons learned. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing flaw 

remediation; NIST Special Publication 800-40; list of flaws and vulnerabilities potentially 

affecting the information system; list of recent security flaw remediation actions performed 

on the information system (e.g., list of installed patches, service packs, hot fixes, and other 

software updates to correct information system flaws); test results from the installation of 

software to correct information system flaws; other relevant documents or records]. (L) (M)

(H)

Interview: [SELECT FROM: Organizational personnel with flaw remediation responsibilities]. (M) (H)

APPENDIX F - SI PAGE F-263 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-2(1) FLAW REMEDIATION 

Control Enhancement:

The organization centrally manages the flaw remediation process and installs updates 

automatically. 

SI-2(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization centrally manages the flaw remediation process and 

installs updates automatically. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing flaw 

remediation; automated mechanisms supporting centralized management of flaw 

remediation and automatic software updates; information system design documentation; 

information system configuration settings and associated documentation; list of information 

system flaws; list of recent security flaw remediation actions performed on the information 

system; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms supporting centralized management of flaw remediation 

and automatic software updates]. (H)

SI-2(2) FLAW REMEDIATION 

Control Enhancement:

The organization employs automated mechanisms to periodically and upon demand determine 

the state of information system components with regard to flaw remediation. 

SI-2(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to periodically and upon 

demand determine the state of information system components with regard to flaw 

remediation. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing flaw 

remediation; automated mechanisms supporting flaw remediation; information system 

design documentation; information system configuration settings and associated 

documentation; list of information system flaws; list of recent security flaw remediation 

actions performed on the information system; information system audit records; other 

relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing information system flaw remediation 

update status]. (M) (H)

APPENDIX F - SI PAGE F-264 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-3 MALICIOUS CODE PROTECTION 

Control: The information system implements malicious code protection. 

Supplemental Guidance: The organization employs malicious code protection mechanisms 

at critical information system entry and exit points (e.g., firewalls, electronic mail servers, 

web servers, proxy servers, remote-access servers) and at workstations, servers, or mobile 

computing devices on the network. The organization uses the malicious code protection 

mechanisms to detect and eradicate malicious code (e.g., viruses, worms, Trojan horses, 

spyware) transported: (i) by electronic mail, electronic mail attachments, Internet 

accesses, removable media (e.g., USB devices, diskettes or compact disks), or other 

common means; or (ii) by exploiting information system vulnerabilities. The 

organization updates malicious code protection mechanisms (including the latest virus 

definitions) whenever new releases are available in accordance with organizational 

configuration management policy and procedures. The organization considers using 

malicious code protection software products from multiple vendors (e.g., using one 

vendor for boundary devices and servers and another vendor for workstations). The 

organization also considers the receipt of false positives during malicious code detection 

and eradication and the resulting potential impact on the availability of the information 

system. NIST Special Publication 800-83 provides guidance on implementing malicious 

code protection. 

SI-3.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system implements malicious code protection; 

(ii) the organization employs malicious code protection mechanisms at critical 

information system entry and exit points, at workstations, servers, or mobile 

computing devices on the network to detect and eradicate malicious code;

(iii) the malicious code protection mechanisms detect and eradicate malicious code 

transported by electronic mail, electronic mail attachments, Internet access, 

removable media, or other common means, or by exploiting information system 

vulnerabilities; 

(iv) the organization updates malicious code protection mechanisms whenever new 

releases are available; and 

(v) the malicious code protection mechanisms are appropriately updated to include the 

latest malicious code definitions, configured to perform periodic scans of the 

information system as well as real-time scans of files from external sources as the 

files are downloaded, opened, or executed, and configured to disinfect and 

quarantine infected files. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing malicious 

code protection; NIST Special Publication 800-83; malicious code protection mechanisms; 

records of malicious code protection updates; information system configuration settings 

and associated documentation; other relevant documents or records]. (L) (M) (H)

APPENDIX F - SI PAGE F-265 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-3(1) MALICIOUS CODE PROTECTION 

Control Enhancement:

The organization centrally manages malicious code protection mechanisms. 

SI-3(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization centrally manages malicious code protection mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing malicious 

code protection; information system design documentation; malicious code protection 

mechanisms; records of malicious code protection updates; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

SI-3(2) MALICIOUS CODE PROTECTION 

Control Enhancement:

The information system automatically updates malicious code protection mechanisms. 

SI-3(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization automatically updates malicious code protection 

mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing malicious 

code protection; information system design documentation; malicious code protection 

mechanisms; records of malicious code protection updates; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Automatic update capability for malicious code protection]. (M) (H)

APPENDIX F - SI PAGE F-266 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-4 INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control: The organization employs tools and techniques to monitor events on the 

information system, detect attacks, and provide identification of unauthorized use of the 

system. 

Supplemental Guidance: Information system monitoring capability is achieved through a 

variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention 

systems, malicious code protection software, audit record monitoring software, network 

monitoring software). Monitoring devices are strategically deployed within the 

information system (e.g., at selected perimeter locations, near server farms supporting 

critical applications) to collect essential information. Monitoring devices are also 

deployed at ad hoc locations within the system to track specific transactions. 

Additionally, these devices are used to track the impact of security changes to the 

information system. The granularity of the information collected is determined by the 

organization based upon its monitoring objectives and the capability of the information 

system to support such activities. Organizations consult appropriate legal counsel with 

regard to all information system monitoring activities. Organizations heighten the level 

of information system monitoring activity whenever there is an indication of increased 

risk to organizational operations, organizational assets, or individuals based on law 

enforcement information, intelligence information, or other credible sources of 

information. NIST Special Publication 800-61 provides guidance on detecting attacks 

through various types of security technologies. NIST Special Publication 800-83 

provides guidance on detecting malware-based attacks through malicious code protection 

software. NIST Special Publication 800-92 provides guidance on monitoring and 

analyzing computer security event logs. NIST Special Publication 800-94 provides 

guidance on intrusion detection and prevention. Related security control: AC-8. 

SI-4.1 ASSESSMENT OBJECTIVE:

Determine if the organization employs tools and techniques to monitor events on the 

information system, detect attacks, and provide identification of unauthorized use of the 

system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; information system design documentation; 

information system monitoring tools and techniques documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

APPENDIX F - SI PAGE F-267 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-4(1) INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control Enhancement:

The organization interconnects and configures individual intrusion detection tools into a 

systemwide intrusion detection system using common protocols. 

SI-4(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization interconnects and configures individual intrusion detection 

tools into a systemwide intrusion detection system using common protocols. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; information system design documentation; 

information system monitoring tools and techniques documentation; information system 

configuration settings and associated documentation; information system protocols; other 

relevant documents or records].

Test: [SELECT FROM: Information system-wide intrusion detection capability]. 

SI-4(2) INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control Enhancement: 

The organization employs automated tools to support near-real-time analysis of events. 

SI-4(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated tools to support near-real-time analysis 

of events. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; information system design documentation; 

information system monitoring tools and techniques documentation; information system 

configuration settings and associated documentation; information system protocols 

documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated tools supporting near real-time event analysis]. (H)

APPENDIX F - SI PAGE F-268 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-4(3) INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control Enhancement:

The organization employs automated tools to integrate intrusion detection tools into access 

control and flow control mechanisms for rapid response to attacks by enabling 

reconfiguration of these mechanisms in support of attack isolation and elimination. 

SI-4(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated tools to integrate intrusion detection 

tools into access control and flow control mechanisms for rapid response to attacks by 

enabling reconfiguration of these mechanisms in support of attack isolation and 

elimination. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; information system design documentation; 

information system monitoring tools and techniques documentation; information system 

configuration settings and associated documentation; information system protocols; other 

relevant documents or records].

Test: [SELECT FROM: Automated tools supporting the integration of intrusion detection tools and 

access/flow control mechanisms].

SI-4(4) INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control Enhancement:

The information system monitors inbound and outbound communications for unusual or 

unauthorized activities or conditions. 

Enhancement Supplemental Guidance: Unusual/unauthorized activities or conditions include, 

for example, the presence of malicious code, the unauthorized export of information, or 

signaling to an external information system. 

SI-4(4).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies the types of activities or conditions considered unusual or 

unauthorized; and 

(ii) the information system monitors inbound and outbound communications for unusual 

or unauthorized activities or conditions. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; types of activities or conditions considered 

unusual or unauthorized; information system monitoring tools and techniques 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Information system monitoring capability for inbound and outbound 

communications]. (M) (H)

APPENDIX F - SI PAGE F-269 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-4(5) 

 

INFORMATION SYSTEM MONITORING TOOLS AND TECHNIQUES 

Control Enhancement:

The information system provides a real-time alert when the following indications of 

compromise or potential compromise occur: [Assignment: organization-defined list of 

compromise indicators]. 

SI-4(5).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization identifies indications of compromise or potential compromise to 

the security of the information system; and 

(ii) the information system provides a real-time alert when any of the organizationdefined list of compromise, or potential compromise indicators occur. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system monitoring tools and techniques; information system security plan; information 

system monitoring tools and techniques documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Information system monitoring real-time alert capability]. (H)

APPENDIX F - SI PAGE F-270 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-5 SECURITY ALERTS AND ADVISORIES 

Control: The organization receives information system security alerts/advisories on a 

regular basis, issues alerts/advisories to appropriate personnel, and takes appropriate 

actions in response. 

Supplemental Guidance: The organization documents the types of actions to be taken in 

response to security alerts/advisories. The organization also maintains contact with 

special interest groups (e.g., information security forums) that: (i) facilitate sharing of 

security-related information (e.g., threats, vulnerabilities, and latest security 

technologies); (ii) provide access to advice from security professionals; and (iii) improve 

knowledge of security best practices. NIST Special Publication 800-40 provides 

guidance on monitoring and distributing security alerts and advisories. 

SI-5.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization receives information system security alerts/advisories on a regular 

basis; 

(ii) the organization issues security alerts/advisories to appropriate organizational 

personnel; and 

(iii) the organization takes appropriate actions in response to security alerts/advisories. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security 

alerts and advisories; NIST Special Publication 800-40; records of security alerts and 

advisories; other relevant documents or records]. (L) (M) (H)

Interview: [SELECT FROM: Organizational personnel with security alert and advisory responsibilities; 

organizational personnel implementing, operating, maintaining, administering, and using 

the information system]. (M) (H)

APPENDIX F - SI PAGE F-271 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-5(1) SECURITY ALERTS AND ADVISORIES 

Control Enhancement: 

The organization employs automated mechanisms to make security alert and advisory 

information available throughout the organization as needed. 

SI-5(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to make security alert and 

advisory information available throughout the organization as needed. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security 

alerts and advisories; information system design documentation; information system 

configuration settings and associated documentation; automated mechanisms supporting 

the distribution of security alert and advisory information; records of security alerts and 

advisories; other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms implementing the distribution of security alert and 

advisory information]. (H)

APPENDIX F - SI PAGE F-272 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-6 SECURITY FUNCTIONALITY VERIFICATION 

Control: The information system verifies the correct operation of security functions 

[Selection (one or more): upon system startup and restart, upon command by user with 

appropriate privilege, periodically every [Assignment: organization-defined time-period]] 

and [Selection (one or more): notifies system administrator, shuts the system down, 

restarts the system] when anomalies are discovered. 

Supplemental Guidance: The need to verify security functionality applies to all security 

functions. For those security functions that are not able to execute automated self-tests, 

the organization either implements compensating security controls or explicitly accepts 

the risk of not performing the verification as required. 

SI-6.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the appropriate conditions for conducting security function 

verification; 

(ii) the organization defines, for periodic security function verification, the frequency of 

the verifications; 

(iii) the organization defines information system responses to anomalies discovered 

during security function verification; 

(iv) the information system verifies the correct operation of security functions in 

accordance with organization-defined conditions and in accordance with 

organization-defined frequency (if periodic verification); and 

(v) the information system responds to security function anomalies in accordance with 

organization-defined responses. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security 

function verification; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; other 

relevant documents or records]. (H)

Test: [SELECT FROM: Security function verification capability]. (H)

APPENDIX F - SI PAGE F-273 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-6(1) SECURITY FUNCTIONALITY VERIFICATION 

Control Enhancement:

The organization employs automated mechanisms to provide notification of failed automated 

security tests. 

SI-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to provide notification of 

failed security tests. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security 

function verification; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; other 

relevant documents or records]. 

Test: [SELECT FROM: Automated mechanisms implementing alerts and/or notifications for failed 

automated security tests].

SI-6(2) SECURITY FUNCTIONALITY VERIFICATION 

Control Enhancement:

The organization employs automated mechanisms to support management of distributed 

security testing. 

SI-6(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated mechanisms to support management of 

distributed security testing. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security 

function verification; information system design documentation; information system security 

plan; information system configuration settings and associated documentation; other 

relevant documents or records]. 

Test: [SELECT FROM: Automated mechanisms supporting the management of distributed security 

function testing].

APPENDIX F - SI PAGE F-274 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-7 SOFTWARE AND INFORMATION INTEGRITY 

Control: The information system detects and protects against unauthorized changes to 

software and information. 

Supplemental Guidance: The organization employs integrity verification applications on the 

information system to look for evidence of information tampering, errors, and omissions. 

The organization employs good software engineering practices with regard to commercial 

off-the-shelf integrity mechanisms (e.g., parity checks, cyclical redundancy checks, 

cryptographic hashes) and uses tools to automatically monitor the integrity of the 

information system and the applications it hosts. 

SI-7.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system detects and protects against unauthorized changes to 

software and information; and 

(ii) the organization employs effective integrity verification tools in accordance with 

good software engineering practices. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing software 

and information integrity; information system design documentation; information system 

configuration settings and associated documentation; integrity verification tools and 

applications documentation; other relevant documents or records]. (H)

Test: [SELECT FROM: Software integrity protection and verification capability]. (H)

APPENDIX F - SI PAGE F-275 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-7(1) SOFTWARE AND INFORMATION INTEGRITY 

Control Enhancement:

The organization reassesses the integrity of software and information by performing 

[Assignment: organization-defined frequency] integrity scans of the system. 

SI-7(1).1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization defines the frequency of integrity scans on the information system; 

and 

(ii) the organization reassesses the integrity of software and information by performing 

integrity scans of the information system in accordance with the organizationdefined frequency. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing software 

and information integrity; information system security plan; information system 

configuration settings and associated documentation; integrity verification tools and 

applications documentation; records of integrity scans; other relevant documents or 

records]. (H)

SI-7(2) SOFTWARE AND INFORMATION INTEGRITY 

Control Enhancement:

The organization employs automated tools that provide notification to appropriate individuals 

upon discovering discrepancies during integrity verification. 

SI-7(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs automated tools that provide notification to 

appropriate individuals upon discovering discrepancies during integrity verification. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing software 

and information integrity; information system configuration settings and associated 

documentation; integrity verification tools and applications documentation; records of 

integrity scans; automated tools supporting alerts and notifications for integrity 

discrepancies; other relevant documents or records]. (H)

APPENDIX F - SI PAGE F-276 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-7(3) SOFTWARE AND INFORMATION INTEGRITY 

Control Enhancement:

The organization employs centrally managed integrity verification tools. 

SI-7(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization employs centrally managed integrity verification tools. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: System and information integrity policy; procedures addressing software and information 

integrity; information system configuration settings and associated documentation; integrity 

verification tools and applications documentation; records of integrity scans; other relevant 

documents or records.

APPENDIX F - SI PAGE F-277 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-8 SPAM PROTECTION 

Control: The information system implements spam protection. 

Supplemental Guidance: The organization employs spam protection mechanisms at critical 

information system entry points (e.g., firewalls, electronic mail servers, remote-access 

servers) and at workstations, servers, or mobile computing devices on the network. The 

organization uses the spam protection mechanisms to detect and take appropriate action 

on unsolicited messages transported by electronic mail, electronic mail attachments, 

Internet accesses, or other common means. Consideration is given to using spam 

protection software products from multiple vendors (e.g., using one vendor for boundary 

devices and servers and another vendor for workstations). NIST Special Publication 800-

45 provides guidance on electronic mail security. 

SI-8.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system implements spam protection; 

(ii) the organization employs spam protection mechanisms at critical information 

system entry points and at workstations, servers, or mobile computing devices on 

the network; 

(iii) the organization employs spam protection mechanisms to detect and take 

appropriate action on unsolicited messages transported by electronic mail; and 

(iv) the organization updates spam protection mechanisms whenever new releases are 

available in accordance with organizational policy and procedures. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing spam 

protection; information system design documentation; spam protection mechanisms; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

Test: [SELECT FROM: Spam detection and handling capability]. (M) (H)

APPENDIX F - SI PAGE F-278 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-8(1) SPAM PROTECTION 

Control Enhancement:

The organization centrally manages spam protection mechanisms. 

SI-8(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization centrally manages spam protection mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing spam 

protection; information system design documentation; spam protection mechanisms; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (H)

SI-8(2) SPAM PROTECTION 

Control Enhancement:

The information system automatically updates spam protection mechanisms. 

SI-8(2).1 ASSESSMENT OBJECTIVE:

Determine if the information system automatically updates spam protection mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing spam 

protection; information system design documentation; spam protection mechanisms; 

information system configuration settings and associated documentation; other relevant 

documents or records].

Test: [SELECT FROM: Automatic update capability for spam protection].

APPENDIX F - SI PAGE F-279 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-9 INFORMATION INPUT RESTRICTIONS 

Control: The organization restricts the capability to input information to the information 

system to authorized personnel. 

Supplemental Guidance: Restrictions on personnel authorized to input information to the 

information system may extend beyond the typical access controls employed by the 

system and include limitations based on specific operational/project responsibilities. 

SI-9.1 ASSESSMENT OBJECTIVE:

Determine if the organization restricts the capability to input information to the 

information system to authorized personnel. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

input restrictions; access control policy and procedures; separation of duties policy and 

procedures; information system design documentation; information system configuration 

settings and associated documentation; other relevant documents or records]. (M) (H)

APPENDIX F - SI PAGE F-280 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-10 INFORMATION ACCURACY, COMPLETENESS, VALIDITY, AND AUTHENTICITY 

Control: The information system checks information for accuracy, completeness, validity, 

and authenticity. 

Supplemental Guidance: Checks for accuracy, completeness, validity, and authenticity of 

information are accomplished as close to the point of origin as possible. Rules for 

checking the valid syntax of information system inputs (e.g., character set, length, 

numerical range, acceptable values) are in place to verify that inputs match specified 

definitions for format and content. Inputs passed to interpreters are prescreened to 

prevent the content from being unintentionally interpreted as commands. The extent to 

which the information system is able to check the accuracy, completeness, validity, and 

authenticity of information is guided by organizational policy and operational 

requirements. 

SI-10.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system checks information for accuracy, completeness, validity, and 

authenticity; 

(ii) checks for accuracy, completeness, validity, and authenticity of information is 

accomplished as close to the point of origin as possible; 

(iii) the information system employs rules to check the valid syntax of information inputs 

to verify that inputs match specified definitions for format and content; and 

(iv) the information system prescreens information inputs passed to interpreters to 

prevent the content from being unintentionally interpreted as commands. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

accuracy, completeness, validity, and authenticity; access control policy and procedures; 

separation of duties policy and procedures; documentation for automated tools and 

applications to verify accuracy, completeness, validity, and authenticity of information; 

information system design documentation; information system configuration settings and 

associated documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Information system capability for checking information for accuracy, 

completeness, validity, and authenticity]. (H)

APPENDIX F - SI PAGE F-281 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-11 ERROR HANDLING 

Control: The information system identifies and handles error conditions in an expeditious 

manner without providing information that could be exploited by adversaries. 

Supplemental Guidance: The structure and content of error messages are carefully 

considered by the organization. Error messages are revealed only to authorized 

personnel. Error messages generated by the information system provide timely and 

useful information without revealing potentially harmful information that could be used 

by adversaries. Sensitive information (e.g., account numbers, social security numbers, 

and credit card numbers) are not listed in error logs or associated administrative 

messages. The extent to which the information system is able to identify and handle error 

conditions is guided by organizational policy and operational requirements. 

SI-11.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the information system identifies and handles error conditions in an expeditious 

manner without providing information that could be exploited by adversaries; 

(ii) the information system reveals only essential information to authorized individuals; 

and 

(iii) the information system does not include sensitive information in error logs or 

associated administrative messages. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system error handling; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or 

records]. (M) (H)

Test: [SELECT FROM: Information system error handling capability]. (H)

APPENDIX F - SI PAGE F-282 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - SI PAGE F-283 

FAMILY: SYSTEM AND INFORMATION INTEGRITY CLASS: OPERATIONAL 

ASSESSMENT PROCEDURE

SI-12 INFORMATION OUTPUT HANDLING AND RETENTION 

Control: The organization handles and retains output from the information system in 

accordance with applicable laws, Executive Orders, directives, policies, regulations, 

standards, and operational requirements. 

Supplemental Guidance: None. 

SI-12.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization handles and retains output from the information system in 

accordance with applicable laws, Executive Orders, directives, policies, 

regulations, standards, and operational requirements; and 

(ii) the organization handles output from the information system in accordance with 

labeled or marked instructions on information system output (including paper and 

digital media) that includes, but not limited to, special instructions for 

dissemination, distribution, transport, or storage of information system output. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: System and information integrity policy; procedures addressing information 

system output handling and retention; media protection policy and procedures; information 

retention records, other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information output handling and retention 

responsibilities]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Section II: Extended Assessment Procedure

EXTENDED ASSESSMENT PROCEDURE

EAP The extended assessment procedure (EAP) and the associated assessment objectives complement the 

other assessment procedures in this catalog. The EAP is employed to verify compliance with the 

assurance requirements in Special Publication 800-53. The EAP is applied on an assessment by 

assessment basis according to how the organization chose to satisfy the assurance requirements in 

Special Publication 800-53 for the information system under assessment. For example, the EAP can 

be applied on a per control basis, per control family basis, per system basis, or per organization basis. 

Organizations retain maximum flexibility in how assessors apply the EAP and should describe its 

specific application in the security assessment plan. 

EAP.1 ASSESSMENT OBJECTIVE:

Determine if the organization has a process in place to address in a timely manner, any 

flaws discovered in the implementation or application of the security controls in the 

information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, documents, activities, or mechanisms related to 

addressing flaws in security controls or control enhancements]. (L) (M) (H)

EAP.2 ASSESSMENT OBJECTIVE:

Determine if the organization has a process in place to assign responsibilities and specific 

actions to support increased grounds for confidence that the security controls in the 

information system are implemented correctly and operating as intended.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, documents, or activities related to assigning 

responsibilities and specific actions for security control implementation and operation]. (M) (H)

Interview: [SELECT FROM: Organizational personnel directly involved in assigning responsibilities and 

specific actions for security control development and implementation]. (H)

EAP.3 ASSESSMENT OBJECTIVE:

Determine if the organization produces and makes available as part of its normal 

development and implementation processes, the necessary documentation and records to 

support increased grounds for confidence that the security controls in the information 

system are implemented correctly and operating as intended.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, and documents related to producing and making 

available documentation and records for security control implementation and operation]. (M)

(H)

EAP.4 ASSESSMENT OBJECTIVE:

Determine if the organization takes actions to improve the effectiveness of the security 

controls in the information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, documents, mechanisms, or activities related to 

taking corrective actions on security controls that exhibit weaknesses or deficiencies]. (H)

Interview: [SELECT FROM: Organizational personnel directly involved in taking corrective actions on 

security controls that exhibit weaknesses or deficiencies]. (H)

APPENDIX F - EAP PAGE F-284 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX F - EAP PAGE F-285 

EXTENDED ASSESSMENT PROCEDURE

EAP.5 ASSESSMENT OBJECTIVE:

Determine if the organization applies security controls consistently across the information 

system to further support increased grounds for confidence that the controls are 

implemented correctly and operating as intended.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Policies, procedures, records, documents, mechanisms, or activities related to 

security control implementation and operation]. (H)

Interview: [SELECT FROM: Organizational personnel directly involved in security control implementation 

and operation]. (H)
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX G

PENETRATION TESTING

ASSESSMENT TOOLS AND TECHNIQUES TO IDENTIFY INFORMATION SYSTEM WEAKNESSES 

rganizations should consider adding controlled penetration testing to their arsenal of tools 

and techniques used to assess the security controls in the information system. 

Penetration testing is a specific type of assessment methodology in which assessors 

simulate the actions of a given class of attacker by using a defined set of documentation (that is, 

the documentation representative of what that class of attacker is likely to possess) and working 

under other specific constraints to attempt to circumvent the security features of an information 

system. Penetration testing is conducted as a controlled attempt to breach the security controls 

employed within the information system using the attacker’s techniques and appropriate hardware 

and software tools. Penetration testing represents the results of a specific assessor or group of 

assessors at a specific point in time using agreed-upon rules of engagement. As such, and 

considering the complexity of the information technologies commonly employed by 

organizations today, penetration testing should be viewed not as a means to verify the security of 

an information system, but rather as a means to: (i) enhance the organization’s understanding of 

the system; (ii) uncover some weaknesses or deficiencies in the system; and (iii) indicate the level 

of effort required on the part of adversaries to breach the system safeguards.50 

O 

Keeping in mind reasonable expectations toward penetration testing results, organizations should 

consider performing controlled penetration testing on moderate-impact and high-impact 

information systems. Penetration testing exercises can be scheduled and/or random in accordance 

with organizational policy and organizational assessments of risk. Consideration should be given 

to performing penetration tests: (i) on any newly developed information system (or legacy system 

undergoing a major upgrade) before the system is authorized for operation; (ii) after important 

changes are made to the environment in which the information system operates; and (iii) when a 

new type of attack is discovered that may impact the system. Organizations actively monitor the 

information systems environment and the threat landscape (e.g., new vulnerabilities, attack 

techniques, new technology deployments, user security awareness and training) to identify 

changes that require out-of-cycle penetration testing. 

Organizations specify which components within the information system are subject to penetration 

testing and the attacker’s profile to be adopted throughout the penetration testing exercises. 

Organizations train selected personnel in the use and maintenance of penetration testing tools and 

techniques. Effective penetration testing tools should have the capability to readily update the list 

of attack techniques and exploitable vulnerabilities used during the exercises. Organizations 

should update the list of attack techniques and exploitable vulnerabilities used in penetration 

testing in accordance with an organizational assessment of risk or when significant new 

vulnerabilities or threats are identified and reported. Whenever possible, organizations should 

employ tools and attack techniques that include the capability to perform penetration testing 

exercises on information systems and security controls in an automated manner. 

The information obtained from the penetration testing process should be shared with appropriate 

personnel throughout the organization to help prioritize the vulnerabilities in the information 

 

50 The failure of an assessor or group of assessors to penetrate an information system may be more indicative of team 

expertise, resources applied, or hindrance by rules of engagement than a statement of overall system security. 

APPENDIX G PAGE G-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX G PAGE G-2 

system that are demonstrably subject to compromise by attackers of a profile equivalent to the 

ones used in the penetration testing exercises. The prioritization helps to determine effective 

strategies for eliminating the identified vulnerabilities and mitigating associated risks to the 

organization’s operations and assets, to individuals, to other organizations, and to the Nation 

resulting from the operation and use of the information system. Penetration testing should be 

integrated into the network security testing process and the patch and vulnerability management 

process. NIST Special Publication 800-40 (Version 2) provides guidance on patch and 

vulnerability management. NIST Special Publication 800-42 provides guidance on network 

security testing. NIST Special Publication 800-115 provides guidance on information security 

testing. 

Penetration Testing Considerations 

Organizations should consider the following in developing and implementing a controlled 

penetration testing program: 

• An effective penetration test goes beyond vulnerability scanning, to provide an explicit 

and often dramatic proof of mission risks and an indicator of the level of effort an 

adversary would need to expend in order to cause harm to the organization’s operations 

and assets, to individuals, to other organizations, or to the Nation; 

• An effective penetration test approaches the information system as the adversary would, 

considering vulnerabilities, incorrect system configurations, trust relationships between 

organizations, and architectural weaknesses in the environment under test; 

• An effective penetration test has a clearly defined scope and contains as a minimum: 

- A definition of the environment subject to test (e.g., facilities, users, organizational 

groups, etc.); 

- A definition of the attack surface to be tested (e.g., servers, desktop systems, wireless 

networks, web applications, intrusion detection and prevention systems, firewalls, email 

accounts, user security awareness and training posture, incident response posture, etc.); 

- A definition of the threat sources to simulate (e.g., an enumeration of attacker’s profiles 

to be used: internal attacker, casual attacker, single or group of external targeted 

attackers, criminal organization, etc.); 

- A definition of level of effort (time and resources) to be expended; and 

- A definition of the rules of engagement. 

• An effective penetration test thoroughly documents all activities performed during the 

test, including all exploited vulnerabilities, and how the vulnerabilities were combined 

into attacks; 

• An effective penetration test produces results indicating a risk level for a given attacker 

by using the level of effort the team needed to expend in penetrating the information 

system as an indicator of the penetration resistance of the system; 

• An effective penetration test validates existing security controls (including risk mitigation 

mechanisms such as firewalls, intrusion detection and prevention systems); 

• An effective penetration test provides a verifiable and reproducible log of all the 

activities performed during the test; and 

• An effective penetration test provides actionable results with information about possible 

remediation measures for the successful attacks performed. 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX H

ASSESSMENT PROCEDURE WORK SHEET

IDENTIFYING AND SELECTING THE BASE SET OF ASSESSMENT PROCEDURES FOR TAILORING 

he work sheet provided in this appendix summarizes all of the assessment procedures and 

associated assessment objectives listed in Appendix F (Assessment Procedure Catalog) by 

NIST Special Publication 800-53 security control/control enhancement identifier. This 

work sheet is intended to assist users of this document in identifying and selecting the base set of 

procedures for assessing the information system security controls. The base set of assessment 

procedures requires tailoring as appropriate (see Section 3.3) to reflect the security controls 

defined and documented in the organization’s information system security plan and to support the 

type of security assessment being conducted. The first column of the work sheet can be used by 

organizations to identify the security controls and control enhancements that are contained in the 

security plan for the information system.51 The second column can be used to identify which 

security controls are part of the current assessment if the organization is conducting a partial 

assessment (for example, conducting an assessment as part of continuous monitoring where a 

subset of the security controls are assessed on an ongoing basis). The third and fourth columns 

list all of the security controls (and control enhancements) in Special Publication 800-53 by 

shorthand identifier and formal control name, respectively. The fifth column lists all of the 

assessment objectives for each assessment procedure in Appendix F. The set of procedures to be 

tailored and used in assessing the security controls in the organizational information system 

correspond to the security controls and security control enhancements checked in the first column 

(or second column for partial assessments). Assessment procedures developed for the assessment 

of organization-specific or system-specific controls not listed in Appendix F must also be 

executed. A section of the work sheet is reserved for listing these additional security controls. 

T

 

51 The security plan column can also be used to indicate whether the security control is a system-specific control, 

common control, or a hybrid control. For common controls, a notation should also be made as to the FIPS 199 impact 

level at which the common control (or the common portion of the hybrid control) is being managed by the organization 

to ensure that it is commensurate with the impact level of the information system being assessed. 

APPENDIX H PAGE H-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Assessment Procedure Work Sheet SECURITY PLAN CURRENT ASSESSMENT CONTROL NUMBER

CONTROL NAME

ASSESSMENT

OBJECTIVES 

Access Control

AC-1 Access Control Policy and Procedures AC-1.1, AC-1.2 

AC-2 Account Management AC-2.1 

AC-2(1) Account Management AC-2(1).1 

AC-2(2) Account Management AC-2(2).1 

AC-2(3) Account Management AC-2(3).1 

AC-2(4) Account Management AC-2(4).1 

AC-3 Access Enforcement AC-3.1 

AC-3(1) Access Enforcement AC-3(1).1 

AC-3 

(ICS-1) 

Access Enforcement AC-3(ICS-1).1 

AC-4 Information Flow Enforcement AC-4.1, AC-4.2 

AC-4(1) Information Flow Enforcement AC-4(1).1 

AC-4(2) Information Flow Enforcement AC-4(2).1 

AC-4(3) Information Flow Enforcement AC-4(3).1 

AC-5 Separation of Duties AC-5.1 

AC-6 Least Privilege AC-6.1 

AC-7 Unsuccessful Login Attempts AC-7.1 

AC-7(1) Unsuccessful Login Attempts AC-7(1).1 

AC-8 System Use Notification AC-8.1 

AC-9 Previous Logon Notification AC-9.1 

AC-10 Concurrent Session Control AC-10.1 

AC-11 Session Lock AC-11.1 

AC-12 Session Termination AC-12.1 

AC-12(1) Session Termination AC-12(1).1 

AC-13 Supervision and Review—Access Control AC-13.1 

AC-13(1) Supervision and Review—Access Control AC-13(1).1 

AC-14 Permitted Actions w/o Identification or Authentication AC-14.1 

AC-14(1) Permitted Actions w/o Identification or Authentication AC-14(1).1 

AC-15 Automated Marking AC-15.1 

AC-16 Automated Labeling AC-16.1 

AC-17 Remote Access AC-17.1 

AC-17(1) Remote Access AC-17(1).1 

AC-17(2) Remote Access AC-17(2).1 

AC-17(3) Remote Access AC-17(3).1 

AC-17(4) Remote Access AC-17(4).1 

AC-18 Wireless Access Restrictions AC-18.1 

AC-18(1) Wireless Access Restrictions AC-18(1).1 

AC-18(2) Wireless Access Restrictions AC-18(2).1 

AC-19 Access Control for Portable and Mobile Devices AC-19.1 

AC-20 Use of External Information Systems AC-20.1 

AC-20(1) Use of External Information Systems AC-20(1).1 

Awareness and Training

AT-1 Security Awareness and Training Policy and Procedures AT-1.1, AT-1.2 

AT-2 Security Awareness AT-2.1 

AT-3 Security Training AT-3.1 

AT-4 Security Training Records AT-4.1 

AT-5 Contacts with Security Groups and Associations AT-5.1 

Audit and Accountability

AU-1 Audit and Accountability Policy and Procedures AU-1.1, AU-1.2 

APPENDIX H PAGE H-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

AU-2 Auditable Events AU-2.1 

AU-2(1) Auditable Events AU-2(1).1 

AU-2(2) Auditable Events AU-2(2).1 

AU-2(3) Auditable Events AU-2(3).1 

AU-3 Content of Audit Records AU-3.1 

AU-3(1) Content of Audit Records AU-3(1).1 

AU-3(2) Content of Audit Records AU-3(2).1 

AU-4 Audit Storage Capacity AU-4.1 

AU-5 Response to Audit Processing Failures AU-5.1 

AU-5(1) Response to Audit Processing Failures AU-5(1).1 

AU-5(2) Response to Audit Processing Failures AU-5(2).1 

AU-6 Audit Monitoring, Analysis, and Reporting AU-6.1, AU-6.2 

AU-6(1) Audit Monitoring, Analysis, and Reporting AU-6(1).1 

AU-6(2) Audit Monitoring, Analysis, and Reporting AU-6(2).1 

AU-7 Audit Reduction and Report Generation AU-7.1 

AU-7(1) Audit Reduction and Report Generation AU-7(1).1 

AU-8 Time Stamps AU-8.1 

AU-8(1) Time Stamps AU-8(1).1 

AU-9 Protection of Audit Information AU-9.1 

AU-9(1) Protection of Audit Information AU-9(1).1 

AU-10 Non-repudiation AU-10.1 

AU-11 Audit Record Retention AU-11.1 

Certification, Accreditation, and Security Assessments

CA-1 Certification, Accreditation, and Security Assessment 

Policies and Procedures 

CA-1.1, CA-1.2 

CA-2 Security Assessments CA-2.1 

CA-3 Information System Connections CA-3.1 

CA-4 Security Certification CA-4.1 

CA-4(1) Security Certification CA-4(1).1 

CA-5 Plan of Action and Milestones CA-5.1 

CA-6 Security Accreditation CA-6.1 

CA-7 Continuous Monitoring CA-7.1, CA-7.2 

CA-7(1) Continuous Monitoring CA-7(1).1 

Configuration Management

CM-1 Configuration Management Policy and Procedures CM-1.1, CM-1.2 

CM-2 Baseline Configuration CM-2.1 

CM-2(1) Baseline Configuration CM-2(1).1 

CM-2(2) Baseline Configuration CM-2(2).1 

CM-3 Configuration Change Control CM-3.1 

CM-3(1) Configuration Change Control CM-3(1).1 

CM-3 

(ICS-1) 

Configuration Change Control CM-3(ICS-1).1 

CM-4 Monitoring Configuration Changes CM-4.1 

CM-5 Access Restrictions for Change CM-5.1 

CM-5(1) Access Restrictions for Change CM-5(1).1 

CM-6 Configuration Settings CM-6.1 

CM-6(1) Configuration Settings CM-6(1).1 

CM-7 Least Functionality CM-7.1 

CM-7(1) Least Functionality CM-7(1).1 

CM-8 Information System Component Inventory CM-8.1 

CM-8(1) Information System Component Inventory CM-8(1).1 

APPENDIX H PAGE H-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

CM-8(2) Information System Component Inventory CM-8(2).1 

Contingency Planning

CP-1 Contingency Planning Policy and Procedures CP-1.1, CP-1.2 

CP-2 Contingency Plan CP-2.1, CP-2.2 

CP-2(1) Contingency Plan CP-2(1).1 

CP-2(2) Contingency Plan CP-2(2).1 

CP-3 Contingency Training CP-3.1, CP-3.2 

CP-3(1) Contingency Training CP-3(1).1 

CP-3(2) Contingency Training CP-3(2).1 

CP-4 Contingency Plan Testing and Exercises CP-4.1, CP-4.2 

CP-4(1) Contingency Plan Testing and Exercises CP-4(1).1 

CP-4(2) Contingency Plan Testing and Exercises CP-4(2).1 

CP-4(3) Contingency Plan Testing and Exercises CP-4(3).1 

CP-5 Contingency Plan Update CP-5.1, CP-5.2 

CP-6 Alternate Storage Site CP-6.1, CP-6.2 

CP-6(1) Alternate Storage Site CP-6(1).1 

CP-6(2) Alternate Storage Site CP-6(2).1 

CP-6(3) Alternate Storage Site CP-6(3).1 

CP-7 Alternate Processing Site CP-7.1, CP-7.2 

CP-7(1) Alternate Processing Site CP-7(1).1 

CP-7(2) Alternate Processing Site CP-7(2).1 

CP-7(3) Alternate Processing Site CP-7(3).1 

CP-7(4) Alternate Processing Site CP-7(4).1, CP-7(4).2 

CP-8 Telecommunications Services CP-8.1, CP-8.2 

CP-8(1) Telecommunications Services CP-8(1).1 

CP-8(2) Telecommunications Services CP-8(2).1 

CP-8(3) Telecommunications Services CP-8(3).1 

CP-8(4) Telecommunications Services CP-8(4).1 

CP-9 Information System Backup CP-9.1, CP-9.2 

CP-9(1) Information System Backup CP-9(1).1 

CP-9(2) Information System Backup CP-9(2).1 

CP-9(3) Information System Backup CP-9(3).1 

CP-9(4) Information System Backup CP-9(4).1 

CP-10 Information System Recovery and Reconstitution CP-10.1, CP-10.2 

CP-10(1) Information System Recovery and Reconstitution CP-10(1).1 

Identification and Authentication

IA-1 Identification and Authentication Policy and Procedures IA-1.1, IA-1.2 

IA-2 User Identification and Authentication IA-2.1 

IA-2(1) User Identification and Authentication IA-2(1).1 

IA-2(2) User Identification and Authentication IA-2(2).1 

IA-2(3) User Identification and Authentication IA-2(3).1 

IA-3 Device Identification and Authentication IA-3.1 

IA-4 Identifier Management IA-4.1, IA-4.2 

IA-5 Authenticator Management IA-5.1 

IA-6 Authenticator Feedback IA-6.1 

IA-7 Cryptographic Module Authentication IA-7.1 

Incident Response

IR-1 Incident Response Policy and Procedures IR-1.1, IR-1.2 

IR-2 Incident Response Training IR-2.1 

IR-2(1) Incident Response Training IR-2(1).1 

IR-2(2) Incident Response Training IR-2(2).1 

APPENDIX H PAGE H-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

IR-3 Incident Response Testing and Exercises IR-3.1 

IR-3(1) Incident Response Testing and Exercises IR-3(1).1 

IR-4 Incident Handling IR-4.1 

IR-4(1) Incident Handling IR-4(1).1 

IR-5 Incident Monitoring IR-5.1 

IR-5(1) Incident Monitoring IR-5(1).1 

IR-6 Incident Reporting IR-6.1 

IR-6(1) Incident Reporting IR-6(1).1 

IR-7 Incident Response Assistance IR-7.1 

IR-7(1) Incident Response Assistance IR-7(1).1 

Maintenance

MA-1 System Maintenance Policy and Procedures MA-1.1, MA-1.2 

MA-2 Controlled Maintenance MA-2.1 

MA-2(1) Controlled Maintenance MA-2(1).1 

MA-2(2) Controlled Maintenance MA-2(2).1 

MA-3 Maintenance Tools MA-3.1 

MA-3(1) Maintenance Tools MA-3(1).1 

MA-3(2) Maintenance Tools MA-3(2).1 

MA-3(3) Maintenance Tools MA-3(3).1 

MA-3(4) Maintenance Tools MA-3(4).1 

MA-4 Remote Maintenance MA-4.1 

MA-4(1) Remote Maintenance MA-4(1).1 

MA-4(2) Remote Maintenance MA-4(2).1 

MA-4(3) Remote Maintenance MA-4(3).1 

MA-5 Maintenance Personnel MA-5.1 

MA-6 Timely Maintenance MA-6.1 

Media Protection

MP-1 Media Protection Policy and Procedures MP-1.1, MP-1.2 

MP-2 Media Access MP-2.1 

MP-2(1) Media Access MP-2(1).1 

MP-3 Media Labeling MP-3.1 

MP-4 Media Storage MP-4.1 

MP-5 Media Transport MP-5.1 

MP-5(1) Media Transport MP-5(1).1 

MP-5(2) Media Transport MP-5(2).1 

MP-5(3) Media Transport MP-5(3).1 

MP-6 Media Sanitization and Disposal MP-6.1 

MP-6(1) Media Sanitization and Disposal MP-6(1).1 

MP-6(2) Media Sanitization and Disposal MP-6(2).1 

Physical and Environmental Protection

PE-1 Physical and Environmental Protection Policy and 

Procedures 

PE-1.1, PE-1.2 

PE-2 Physical Access Authorizations PE-2.1 

PE-3 Physical Access Control PE-3.1, PE-3.2, PE-3.3 

PE-3(1) Physical Access Control PE-3(1).1 

PE-4 Access Control for Transmission Medium PE-4.1 

PE-5 Access Control for Display Medium PE-5.1 

PE-6 Monitoring Physical Access PE-6.1 

PE-6(1) Monitoring Physical Access PE-6(1).1 

PE-6(2) Monitoring Physical Access PE-6(2).1 

PE-7 Visitor Control PE-7.1 

PE-7(1) Visitor Control PE-7(1).1 

APPENDIX H PAGE H-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

PE-8 Access Records PE-8.1 

PE-8(1) Access Records PE-8(1).1 

PE-8(2) Access Records PE-8(2).1 

PE-9 Power Equipment and Power Cabling PE-9.1 

PE-9(1) Power Equipment and Power Cabling PE-9(1).1 

PE-10 Emergency Shutoff PE-10.1 

PE-10(1) Emergency Shutoff PE-10(1).1 

PE-11 Emergency Power PE-11.1 

PE-11(1) Emergency Power PE-11(1).1 

PE-11(2) Emergency Power PE-11(2).1 

PE-12 Emergency Lighting PE-12.1 

PE-13 Fire Protection PE-13.1 

PE-13(1) Fire Protection PE-13(1).1 

PE-13(2) Fire Protection PE-13(2).1 

PE-13(3) Fire Protection PE-13(3).1 

PE-14 Temperature and Humidity Controls PE-14.1 

PE-15 Water Damage Protection PE-15.1 

PE-15(1) Water Damage Protection PE-15(1).1 

PE-16 Delivery and Removal PE-16.1 

PE-17 Alternate Work Site PE-17.1 

PE-18 Location of Information System Components PE-18.1 

PE-18(1) Location of Information System Components PE-18(1).1 

PE-19 Information Leakage PE-19.1 

Planning

PL-1 Security Planning Policy and Procedures PL-1.1, PL-1.2 

PL-2 System Security Plan PL-2.1 

PL-3 System Security Plan Update PL-3.1 

PL-4 Rules of Behavior PL-4.1 

PL-5 Privacy Impact Assessment PL-5.1 

PL-6 Security-Related Activity Planning PL-6.1 

Personnel Security

PS-1 Personnel Security Policy and Procedures PS-1.1, PS-1.2 

PS-2 Position Categorization PS-2.1 

PS-3 Personnel Screening PS-3.1 

PS-4 Personnel Termination PS-4.1 

PS-5 Personnel Transfer PS-5.1 

PS-6 Access Agreements PS-6.1 

PS-7 Third-Party Personnel Security PS-7.1 

PS-8 Personnel Sanctions PS-8.1 

Risk Assessment

RA-1 Risk Assessment Policy and Procedures RA-1.1, RA-1.2 

RA-2 Security Categorization RA-2.1 

RA-3 Risk Assessment RA-3.1 

RA-4 Risk Assessment Update RA-4.1 

RA-5 Vulnerability Scanning RA-5.1 

RA-5(1) Vulnerability Scanning RA-5(1).1 

RA-5(2) Vulnerability Scanning RA-5(2).1 

RA-5(3) Vulnerability Scanning RA-5(3).1 

System and Services Acquisition

SA-1 System and Services Acquisition Policy and Procedures SA-1.1, SA-1.2 

SA-2 Allocation of Resources SA-2.1 

APPENDIX H PAGE H-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

SA-3 Life Cycle Support SA-3.1 

SA-4 Acquisitions SA-4.1 

SA-4(1) Acquisitions SA-4(1).1 

SA-4(2) Acquisitions SA-4(2).1 

SA-5 Information System Documentation SA-5.1 

SA-5(1) Information System Documentation SA-5(1).1 

SA-5(2) Information System Documentation SA-5(2).1 

SA-6 Software Usage Restrictions SA-6.1 

SA-7 User Installed Software SA-7.1 

SA-8 Security Engineering Principles SA-8.1 

SA-9 External Information System Services SA-9.1 

SA-10 Developer Configuration Management SA-10.1 

SA-11 Developer Security Testing SA-11.1 

System and Communications Protection

SC-1 System and Communications Protection Policy and 

Procedures 

SC-1.1, SC-1.2 

SC-2 Application Partitioning SC-2.1 

SC-3 Security Function Isolation SC-3.1 

SC-3(1) Security Function Isolation SC-3(1).1 

SC-3(2) Security Function Isolation SC-3(2).1 

SC-3(3) Security Function Isolation SC-3(3).1 

SC-3(4) Security Function Isolation SC-3(4).1 

SC-3(5) Security Function Isolation SC-3(5).1 

SC-4 Information Remnance SC-4.1 

SC-5 Denial of Service Protection SC-5.1 

SC-5(1) Denial of Service Protection SC-5(1).1 

SC-5(2) Denial of Service Protection SC-5(2).1 

SC-6 Resource Priority SC-6.1 

SC-7 Boundary Protection SC-7.1 

SC-7(1) Boundary Protection SC-7(1).1 

SC-7(2) Boundary Protection SC-7(2).1 

SC-7(3) Boundary Protection SC-7(3).1 

SC-7(4) Boundary Protection SC-7(4).1 

SC-7(5) Boundary Protection SC-7(5).1 

SC-7(6) Boundary Protection SC-7(6).1 

SC-8 Transmission Integrity SC-8.1 

SC-8(1) Transmission Integrity SC-8(1).1 

SC-9 Transmission Confidentiality SC-9.1 

SC-9(1) Transmission Confidentiality SC-9(1).1 

SC-10 Network Disconnect SC-10.1 

SC-11 Trusted Path SC-11.1 

SC-12 Cryptographic Key Establishment and Management SC-12.1 

SC-13 Use of Cryptography SC-13.1 

SC-14 Public Access Protections SC-14.1 

SC-15 Collaborative Computing SC-15.1 

SC-15(1) Collaborative Computing SC-15(1).1 

SC-16 Transmission of Security Parameters SC-16.1 

SC-17 Public Key Infrastructure Certificates SC-17.1 

SC-18 Mobile Code SC-18.1 

SC-19 Voice Over Internet Protocol SC-19.1 

SC-20 Secure Name /Address Resolution Service 

(Authoritative Source) 

SC-20.1 

APPENDIX H PAGE H-7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ SECURITY PLAN CURRENT ASSESSMENT CONTROL

CONTROL NAME

ASSESSMENT

NUMBER

OBJECTIVES 

SC-20(1) Secure Name /Address Resolution Service 

(Authoritative Source) 

SC-20(1).1 

SC-21 Secure Name /Address Resolution Service (Recursive or 

Caching Resolver) 

SC-21.1 

SC-21(1) Secure Name /Address Resolution Service (Recursive or 

Caching Resolver) 

SC-21(1).1 

SC-22 Architecture and Provisioning for Name/Address 

Resolution Service 

SC-22.1 

SC-23 Session Authenticity SC-23.1 

System and Information Integrity

SI-1 System and Information Integrity Policy and Procedures SI-1.1, SI-1.2 

SI-2 Flaw Remediation SI-2.1 

SI-2(1) Flaw Remediation SI-2(1).1 

SI-2(2) Flaw Remediation SI-2(2).1 

SI-3 Malicious Code Protection SI-3.1 

SI-3(1) Malicious Code Protection SI-3(1).1 

SI-3(2) Malicious Code Protection SI-3(2).1 

SI-4 Information System Monitoring Tools and Techniques SI-4.1 

SI-4(1) Information System Monitoring Tools and Techniques SI-4(1).1 

SI-4(2) Information System Monitoring Tools and Techniques SI-4(2).1 

SI-4(3) Information System Monitoring Tools and Techniques SI-4(3).1 

SI-4(4) Information System Monitoring Tools and Techniques SI-4(4).1 

SI-4(5) Information System Monitoring Tools and Techniques SI-4(5).1 

SI-5 Security Alerts and Advisories SI-5.1 

SI-5(1) Security Alerts and Advisories SI-5(1).1 

SI-6 Security Functionality Verification SI-6.1 

SI-6(1) Security Functionality Verification SI-6(1).1 

SI-6(2) Security Functionality Verification SI-6(2).1 

SI-7 Software and Information Integrity SI-7.1 

SI-7(1) Software and Information Integrity SI-7(1).1 

SI-7(2) Software and Information Integrity SI-7(2).1 

SI-7(3) Software and Information Integrity SI-7(3).1 

SI-8 Spam Protection SI-8.1 

SI-8(1) Spam Protection SI-8(1).1 

SI-8(2) Spam Protection SI-8(2).1 

SI-9 Information Input Restrictions SI-9.1 

SI-10 Information Accuracy, Completeness, Validity, and 

Authenticity 

SI-10.1 

SI-11 Error Handling SI-11.1 

SI-12 Information Output Handling and Retention SI-12.1 

APPENDIX H PAGE H-8 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX H PAGE H-9 SECURITY PLAN CURRENT ASSESSMENT CONTROL NUMBER

CONTROL NAME

ASSESSMENT

OBJECTIVES 

Additional Security Controls Not Contained in NIST Special Publication 800-53
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX I

SECURITY ASSESSMENT REPORTS

DOCUMENTING THE FINDINGS FROM SECURITY CONTROL ASSESSMENTS 

he primary purpose of the security assessment report is to convey the results of the 

security assessment to appropriate organizational officials.52 The security assessment 

report provides a disciplined and structured approach for documenting the findings of the 

assessor and the recommendations for correcting any weaknesses or deficiencies in the security 

controls. This appendix provides a template for reporting the results from the assessments of 

security controls. It is anticipated that the overall report of an assessment (i.e., the security 

assessment report) will consist of the template filled in for each security control assessed, 

preceded by a summary providing the list of all security controls assessed and the overall status of 

each control. 

T 

Key Elements for Assessment Reporting

The following elements should be included in security assessment reports: 

• Information System Name and Impact Level 

• Site(s) Assessed and Assessment Date(s) 

• Security Control or Control Enhancement and Associated Supplemental Guidance 

• For Each Assessment Objective (determination statements): 

- Assessment Methods and Objects 

- Assessment Finding Summary (indicating satisfied or other than satisfied) 

• Assessor Comments (deficiencies or weaknesses noted) 

• Assessor Recommendations (remediation, corrective actions, or improvements) 

 

52 The security assessment report is included in the security accreditation package along with the information system 

security plan (including updated risk assessment), and the plan of action and milestones to provide authorizing officials 

with the information necessary to make credible, risk-based decisions on whether to place an information system into 

operation or continue its operation. As the security certification and accreditation process becomes more dynamic in 

nature, relying to a greater degree on the continuous monitoring aspects of the process as an integrated and tightly 

coupled part of the system development life cycle, the ability to update the security assessment report frequently 

becomes a critical aspect of an information security program. It is important to emphasize the relationship, described in 

NIST Special Publication 800-37, among the three key documents in the accreditation package (i.e., the system security 

plan including risk assessment, the security assessment report, and the plan of action and milestones). It is these 

documents that provide the best indication of the overall security status of the information system and the ability of the 

system to protect, to the degree necessary, the organization’s operations and assets, individuals, other organizations, 

and the Nation. Updates to these key documents should be provided on an ongoing basis in accordance with the 

continuous monitoring program established by the organization. 

APPENDIX I PAGE I-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

The Assessment Findings

Each determination statement executed by an assessor results in one of the following findings: (i) 

satisfied (S); or (ii) other than satisfied (O). Consider the following example for security control 

CP-1. The assessment procedure for CP-1 consists of two assessment objectives denoted CP-1.1 

and CP-1.2. The assessor initially executes CP-1.1 and produces the following findings: 

CP-1.1 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the organization develops and documents contingency planning policy and 

procedures; (S)

(ii) the organization disseminates contingency planning policy and procedures to 

appropriate elements within the organization; (O)

(iii) responsible parties within the organization periodically review contingency 

planning policy and procedures; and (S)

(iv) the organization updates contingency planning policy and procedures when 

organizational review indicates updates are required. (O)

Comments and Recommendations: 

CP-1.1(ii) is marked as other than satisfied because there was insufficient evidence to 

determine if the following two of the ten identified organizational elements on the distribution 

list for the contingency planning policy and procedures actually had received the policy and 

procedures: (i) organization physical security office; and (ii) organization finance and 

accounting office. Straightforward remediation action recommended of providing necessary 

documentation to the two organizational elements not receiving the policy and procedures. 

CP-1.1 (iv) is marked as other than satisfied because over fifty percent of the contingency 

planning policy and procedure documents identified as requiring updates had not in fact been 

updated. Significant remediation action is recommended to correct clear process deficiencies.

In a similar manner, the assessor executes CP-1.2 and produces the following findings: 

CP-1.2 ASSESSMENT OBJECTIVE:

Determine if: 

(i) the contingency planning policy addresses purpose, scope, roles and 

responsibilities, management commitment, coordination among organizational 

entities, and compliance; (S)

(ii) the contingency planning policy is consistent with the organization’s mission and 

functions and with applicable laws, directives, policies, regulations, standards, and 

guidance; and (S)

(iii) the contingency planning procedures address all areas identified in the contingency 

planning policy and address achieving policy-compliant implementations of all 

associated security controls. (O)

Comments and Recommendations: 

CP-1.2(iii) is marked as other than satisfied because the assessment team could not make a 

determination. The entire suite of updated contingency planning procedures (identified in CP1.1(iv) finding) was unavailable and therefore, the sufficiency of contingency planning policy 

coverage could not be determined. Further investigation is needed. 

During an actual security control assessment, the assessment findings, comments, and 

recommendations would be documented on the Security Assessment Reporting Form provided in 

this appendix.

APPENDIX I PAGE I-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

Sample Security Assessment Reporting Form 

To help organizations collect, organize, and report the findings of individual security control 

assessments for the information system, a sample reporting form is provided below. This sample 

reporting form is illustrative and is intended to be used for each security control and control 

enhancement included in the security control assessment. The form is not intended to limit the 

flexibility of organizations in determining the most appropriate presentation of assessment 

findings for the purposes of a given security control assessment. 

SECURITY ASSESSMENT REPORTING FORM

SECTION I: INFORMATION SYSTEM AND ASSESSMENT INFORMATION

Information System Name Impact Level 

Low, Moderate, High

Site(s) Assessed Assessment Date(s) 

Information System Components Where Security Control Employed (e.g., firewall, router, workstation, server, laptop, PDA)

SECTION II: SECURITY CONTROL INFORMATION 

Security Control or Control Enhancement 

Insert text from security control or control enhancement being assessed as stated in, or as referenced by the approved system security plan. 

Supplemental Guidance Associated with Security Control or Control Enhancement 

Insert text from the supplemental guidance from the security control or control enhancement being assessed as stated in, or as referenced by the 

approved system security plan.

SECTION III: ASSESSMENT FINDINGS 

Assessment Objective 

Identify assessment objective (e.g., CP-1.1, associated with the security control or control enhancement described above).

Determination Statements 

See determination statements below which restate the determinations from the assessment objective, as tailored for this security 

control assessment (e.g., including organization-specific information, where appropriate).

Finding 

(S/O)

Determination Statement 

Determination Statement 

Determination Statement 

Determination Statement 

APPENDIX I PAGE I-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX I PAGE I-4 

SECURITY ASSESSMENT REPORTING FORM

Assessment Methods and Objects 

Identify assessment methods and assessment objects as tailored for this assessment, e.g., the specific version of a specification examined or the 

nature of the examination performed.

SECTION IV: ASSESSOR COMMENTS AND RECOMMENDATIONS 

Assessor Comments 

Explanation of weaknesses or deficiencies noted for each finding of other than satisfied.

Assessor Recommendations 

Recommendations for remediation, corrective actions, or improvements in security control implementation or operation.
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX J

ASSESSMENT CASES

WORKED EXAMPLES OF ASSESSOR ACTIONS DERIVED FROM ASSESSMENT PROCEDURES 

o provide assessors with additional tools and techniques for implementing the assessment 

procedures in Appendix F, NIST initiated the Assessment Case Development Project.

53 

The purpose of the project is threefold: (i) actively engage experienced assessors from 

multiple organizations in recommending assessment cases that describe specific assessor actions 

to implement the assessment procedures in Appendix F; (ii) provide organizations and the 

assessors supporting those organizations with an exemplary set of assessment cases for each 

assessment procedure in Appendix F; and (iii) provide a vehicle for ongoing community-wide 

review and comment of the assessment cases to promote continuous improvement in the 

assessment process for more consistent, effective, and cost-effective security assessments of 

federal information systems. The assessment case development process is described in this 

appendix and several examples of assessment cases are provided. The full set of assessment 

cases will be maintained on the NIST web site at http://csrc.nist.gov/sec-cert. 

T 

Assessment Case Description and Template

The concept of assessment cases emerged during the development process of NIST Special 

Publication 800-53A. Some organizations prefer the flexibility offered by the generalized 

assessment procedures in Appendix F, with the opportunity to tailor the procedures for specific 

organizational requirements and operational environments and to create specific assessor actions 

and activities for a particular security assessment. Other organizations prefer a more prescriptive 

approach and desire, to the greatest extent possible, a predefined set of specific assessor actions 

and activities needed to successfully carry out a security assessment. To facilitate the specificity 

of the latter approach while maintaining the flexibility of the former approach, assessment cases 

are under development for all assessment procedures in Appendix F of this document. 

An assessment case represents a worked example of an assessment procedure that provides 

specific actions that an assessor would carry out during the assessment of a security control or 

control enhancement in an information system. Each assessment case corresponds to one 

assessment objective from an assessment procedure in Appendix F. The assessment case 

provides an example by experienced assessors of selecting assessment methods and objects from 

the list of potential methods and objects and adding a description of the level of effort to be 

applied during the assessment.54 This additional level of detail helps in achieving consistency 

across assessments and in obtaining agreement among assessors and the users/evaluators of 

assessment results on the actions and level of effort needed to develop the assessment evidence 

necessary to adequately satisfy the assessment objectives. 

 

53 NIST initiated the Assessment Case Development Project in October 2007 in cooperation with the Departments of 

Justice, Energy, Transportation, and the Intelligence Community. The interagency task force is developing a full suite 

of assessment cases based on the assessment procedures provided in NIST Special Publication 800-53A. The 

assessment cases, when completed, will be available to all organizations, both public and private sector, on the NIST 

web site at http://csrc.nist.gov/sec-cert. Assessment cases will be subject to the same public vetting process currently 

employed for NIST security standards and guidelines, with ongoing improvement expected over time. Organizations 

are encouraged to participate in the Assessment Case Development Project to take advantage of the tools and 

techniques available to help bring greater consistency and cost-effectiveness to security control assessments across the 

federal government. 

54 The level of effort for an assessment is based on the depth and coverage appropriate for the intent of the assessor 

actions, in light of the impact level of the information systems being assessed (see Appendix D). 

APPENDIX J PAGE J-1 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

The following template is used to create the specific assessment cases for the assessment 

procedures in Appendix F. 

ASSESSMENT CASE

AA-N [Security Control Name] 

Determination 

Statement No. ASSESSMENT OBJECTIVE

AA-N.x Determine if: 

AA-N.x.1 [Determination statement 1 from SP 800-53A.] 

 : 

 : : 

 :

AA-N.x.n [Determination statement n from SP 800-53A.] 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Assessment Method: [Select from: Assessment Objects from SP 800-53A] 

Assessment Method: [Select from: Assessment Objects from SP 800-53A] 

Assessment Method: [Select from: Assessment Objects from SP 800-53A] 

RELATED CONTROL INFORMATION 

This section contains information necessary to effectively order assessment activities so that information is available when 

an assessment procedure is executed and information for later procedures can be captured in the efforts of earlier 

procedures using the same assessment objects. 

PRECURSOR CONTROLS: 

CONCURRENT CONTROLS: 

SUCCESSOR CONTROLS:

Action Number Applied Potential Assessor Actions 

AA-N.x.1.1 [L, M, H] [<Assessment Method> <Assessment Object(s)> <Level of Effort> <Purpose Statement55>] 

 : 

 :

 : 

 :

 : 

 :

AA-N.x.1.n [L, M, H] [<Assessment Method> <Assessment Object(s)> <Level of Effort> <Purpose Statement>] 

Legend 

AA: Alphanumeric characters representing security control family in NIST Special Publication 800-53. 

N: Numeric character representing the security control number within the family of controls. 

Assessment Method: Examine, Interview, or Test 

 

55 The purpose statement describes why the particular assessment action is needed (i.e., a statement of information or 

evidence to be obtained in support of making the associated determination in the determination statement). 

APPENDIX J PAGE J-2 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

 Cautionary Note 

The assessment cases developed for this project are not the only acceptable assessment cases; rather, 

the cases represent one possible set of options for organizations (and assessors supporting those 

organizations) to use in helping to determine the effectiveness of the security controls employed within 

the information systems undergoing assessments. The following assessment procedures from 

Appendix F have been selected to illustrate how assessment cases are developed from the template on 

the preceding page. Each of the assessment procedures includes a corresponding assessment case for 

each assessment objective. The assessment cases and any ongoing updates to the cases, will be 

published on the FISMA Implementation Project web site at http://csrc.nist.gov/sec-cert. 

The initial set of assessment cases will be posted on the NIST web site as the cases are completed by 

the Assessment Case Development Project team beginning in January 2008. It is anticipated that all 

assessment cases will be available when NIST Special Publication 800-53A is finalized in March 2008. 

APPENDIX J PAGE J-3 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

 EXAMPLE ONE: ASSESSMENT CASE FOR MANAGEMENT SECURITY CONTROL 

ASSESSMENT CASE

CA-7 CONTINUOUS MONITORING

Determination 

Statement No. ASSESSMENT OBJECTIVE

CA-7.1 Determine if: 

CA-7.1.1 (i) the organization monitors the security controls in the information system on an 

ongoing basis; and 

CA-7.1.2 (ii) the organization employs a security control monitoring process consistent with NIST 

Special Publications 800-37 and 800-53A. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing continuous 

monitoring of information system security controls; NIST Special Publications 800-37 and 

800-53A; information system security plan; security assessment report; plan of action and 

milestones; information system monitoring records; security impact analyses; status 

reports; other relevant documents or records]. (L) (M) (H) 

Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: CA-2, CA-4, CA-5, CA-6, CM-4. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CA-7.1.1.1 L Examine security assessment report results or information system monitoring records; reviewing for indication 

of assessment of the security controls identified for continuous monitoring in the system security plan. 

CA-7.1.1.2 M H Examine security assessment report results; studying for evidence that all security controls identified for 

continuous monitoring at information system or organization level are assessed in accordance with 

organizational policy and system security plan requirements. 

CA-7.1.2.1 L Examine organizational continuous monitoring policy and procedures; reviewing for consistency with NIST 

Special Publications 800-37 and 800-53A continuous monitoring requirements. 

CA-7.1.2.2 M H Examine organizational continuous monitoring policy and procedures; studying for consistency with NIST 

Special Publications 800-37 and 800-53A continuous monitoring requirements.

CA-7.1.2.3 H Interview system owner; in-depth discussion to confirm understanding of organization’s continuous monitoring 

requirements. 

APPENDIX J PAGE J-4 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE ONE: ASSESSMENT CASE FOR MANAGEMENT SECURITY CONTROL 

ASSESSMENT CASE

CA-7 CONTINUOUS MONITORING

Determination 

Statement No. ASSESSMENT OBJECTIVE

CA-7.2 Determine if: 

CA-7.2.1 (i) the organization conducts security impact analyses on changes to the information 

system; 

CA-7.2.2 (ii) the organization documents and reports changes to or deficiencies in the security 

controls employed in the information system; and 

CA-7.2.3 (iii) the organization makes adjustments to the information system security plan and plan 

of action and milestones, as appropriate, based on the activities associated with 

continuous monitoring of the security controls. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Certification and accreditation policy; procedures addressing continuous 

monitoring of information system security controls; information system security plan; 

security assessment report; plan of action and milestones; information system monitoring 

records; security impact analyses; status reports; other relevant documents or records]. (L)

(M) (H)

Interview: [SELECT FROM: Organizational personnel with continuous monitoring responsibilities]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: CA-2, CA-4, CA-5, CA-6, CM-4. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CA-7.2.1.1 L M H Examine configuration change records and documents (e.g., system change request, configuration control 

board meeting minutes) containing security impact analyses; reviewing for indication that the organization is 

assessing the potential security impacts of changes to hardware, software, or the operating environment. 

(Reference CM-4) 

CA-7.2.1.2 H Interview system owner and a representative sample of personnel responsible for performing security impact 

analyses; conducting probing discussions to validate that effective security impact analyses are being 

conducted for changes to the information system. 

CA-7.2.2.1 L M H Interview system owner; conducting a discussion to define how changes to or deficiencies in security controls 

employed in the information system are documented and reported to the authorizing official.

CA-7.2.2.2 M H Examine control monitoring documentation; analyzing to verify that all known deficiencies in security controls 

employed in the information system are documented and reported by the system owner to the authorizing 

official. 

CA-7.2.3.1 L Examine the system security plan and the plan of action and milestones for the information system; reviewing 

for indication that deficiencies in or changes to security controls are reflected in updates to those documents. 

CA-7.2.3.2 M H Examine the system security plan and the plan of action and milestones for the information system; analyzing 

to verify that deficiencies in or changes to security controls have been addressed in updates to those 

documents. 

 

APPENDIX J PAGE J-5 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9 INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9.1 Determine if: 

CP-9.1.1 (i) the organization defines the frequency of information systems backups; 

CP-9.1.2 (ii) the organization defines the user-level and system-level information (including 

system state information) that is required to be backed up; and 

CP-9.1.3 (iii) the organization identifies the location(s) for storing backup information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; backup storage location(s); 

other relevant documents or records]. (L) (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9.1.1.1 L M H Examine the backup procedures or contingency plan; reviewing for definition of a backup frequency.

CP-9.1.2.1 L M H Examine the backup procedures or information system security plan; reviewing for definition of user-level and 

system-level information to be backed up. 

CP-9.1.3.1 L M H Examine the backup procedures or contingency plan; reviewing for identification of location(s) for storing 

backup information.

APPENDIX J PAGE J-6 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9 INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9.2 Determine if: 

CP-9.2.1 (i) the organization backs up the required user-level and system-level information 

(including system state information) in accordance with the organization-defined 

frequency; 

CP-9.2.2 (ii) the organization stores backup information in designated locations in accordance 

with information system backup procedures; and 

CP-9.2.3 (iii) the organization protects backup information at the designated storage locations. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; backup storage location(s); 

other relevant documents or records]. (L) (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9.2.1.1 L Examine the backup logs; reviewing for indication that backups are occurring according to the organizationdefined frequency.

CP-9.2.1.2 M H Examine the backup logs; studying to verify that the organization backs up the required system and user 

information, according to the organization-defined frequency. 

CP-9.2.2.1 L M H Examine the backup procedures; reviewing for indication that the organization stores the system backups in 

the designated locations. 

CP-9.2.2.2 M H Examine the alternate storage agreement (see CP-6) and backup records; studying to ensure the information 

is being stored in designated locations in accordance with information system backup procedures. 

CP-9.2.3.1 L Examine the backup procedures and alternate storage agreement; reviewing for indication that the 

organization protects backup information at the storage location.

CP-9.2.3.2 M H Examine the backup procedures, alternate storage agreement, and backup records; analyzing to verify that 

the organization protects backup information at the storage location.

APPENDIX J PAGE J-7 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9(1) INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9(1).1 Determine if: 

CP-9(1).1.1 (i) the organization defines the frequency of information system backup testing; 

CP-9(1).1.2 (ii) the organization conducts information system backup testing within the 

organization-defined frequency; and 

CP-9(1).1.3 (iii) testing results verify backup media reliability and information integrity. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system security plan; information system backup 

test results; backup storage location(s); other relevant documents or records]. (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9(1).1.1.1 M H Examine the information system security plan; reviewing for definition of frequency of information system 

backup testing. 

CP-9(1).1.2.1 M H Examine the backup test results; reviewing to verify that backup testing is being performed according to 

organization-defined frequency. 

CP-9(1).1.3.1 M H Examine the backup test results; studying to confirm that backup testing has verified media reliability and 

information integrity.

APPENDIX J PAGE J-8 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9(2) INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9(2).1 Determine if: 

CP-9(2).1.1 (i) the organization selectively uses backup information in the restoration of 

information system functions as part of contingency plan testing. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system backup test results; contingency plan test 

results; other relevant documents or records]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9(2).1.1.1 H Examine the contingency plan test results; reviewing to verify that a sample of the backup information is used 

in the restoration of information system functions. 

APPENDIX J PAGE J-9 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9(3) INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9(3).1 Determine if: 

CP-9(3).1.1 (i) the organization stores backup copies of operating system and other critical 

information system software in a separate facility or in a fire-rated container that is 

not collocated with the operational software. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; backup storage location(s); other relevant documents or 

records]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9(3).1.1.1 H Examine the contingency plan and/or backup procedures; reviewing to confirm that backup copies of the 

operating system and other critical information system software are stored in a separate facility or in a firerated container that is not collocated with the operational information system. 

CP-9(3).1.1.2 H Examine the backup storage location(s); inspecting to confirm that backup copies of the operating system and 

other critical information system software are stored in a separate facility or in a fire-rated container that is not 

collocated with the operational information system.

APPENDIX J PAGE J-10 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE TWO: ASSESSMENT CASE FOR OPERATIONAL SECURITY CONTROL 

ASSESSMENT CASE

CP-9(4) INFORMATION SYSTEM BACKUP

Determination 

Statement No. ASSESSMENT OBJECTIVE

CP-9(4).1 Determine if: 

CP-9(4).1.1 (i) the organization employs appropriate mechanisms to protect the integrity of 

information system backup information. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Contingency planning policy; contingency plan; procedures addressing 

information system backup; information system design documentation; backup storage 

location(s); information system configuration settings and associated documentation; other 

relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Organizational personnel with information system backup responsibilities]. 

(M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: CP-6. 

CONCURRENT CONTROLS: MP-4, MP-5. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

CP-9(4).1.1.1 M H Examine the backup procedures and/or alternate storage agreements; performing a review to ensure that the 

organization employs appropriate mechanisms (e.g., digital signatures, cryptographic hashes) to protect the 

integrity of information system backups. 

CP-9(4).1.1.2 H Interview a representative sample of personnel with system design responsibilities and a representative 

sample of personnel with performance of backup responsibilities; conducting in-depth discussions to confirm 

that the organization employs the mechanisms identified in the examination of CP-9(4).1.1.1 to protect the 

integrity of information system backups. 

APPENDIX J PAGE J-11 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE THREE: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

IA-2 USER IDENTIFICATION AND AUTHENTICATION

Determination 

Statement No. ASSESSMENT OBJECTIVE

IA-2.1 Determine if: 

IA-2.1.1 (i) the information system uniquely identifies and authenticates users (or processes 

acting on behalf of users); and 

IA-2.1.2 (ii) authentication levels for users (or processes acting on behalf of users) are consistent 

NIST Special Publication 800-63 and e-authentication risk assessment results. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system design 

documentation; e-authentication risk assessment results; information system configuration 

settings and associated documentation; information system audit records; other relevant 

documents or records]. (L) (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing identification and authentication capability 

for the information system]. (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: IA-1. 

CONCURRENT CONTROLS: AC-14, AC-17, AU-3, IA-6, PL-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

IA-2.1.1.1 L M H Examine information system security plan, or other relevant documentation; reviewing for indication that each 

system user (or process acting on behalf of a user) is uniquely identified; except as indicated in AC-14. 

IA-2.1.1.2 L Examine information system security plan, or other relevant documentation; reviewing for indication that the 

claimed identity for each user (or process acting on behalf of a user) is authenticated, except as indicated in 

AC-14; for example, through the use of passwords, tokens, biometrics, or in the case of multifactor 

authentication, some combination thereof. 

IA-2.1.1.3 M H Examine system design documentation and associated documentation (e.g., software design, technical 

design, information system security plan, or other system development life cycle documentation); studying for 

evidence that the claimed identity for each user (or process acting on behalf of a user) is authenticated, except 

as indicated in AC-14; for example, through the use of passwords, tokens, biometrics, or in the case of 

multifactor authentication, some combination thereof. 

IA-2.1.1.4 H Examine a comprehensive sample of the system configuration settings to ensure that system identifiers are 

unique to each user (or process acting on behalf of a user) across the components/applications that make up 

the information system. 

IA-2.1.2.1 L Examine system documentation; reviewing for indication that authentication levels identified for different types 

of users (or processes acting on behalf of users) are implemented in a manner consistent with NIST Special 

Publication 800-63 requirements for those levels. 

IA-2.1.2.2 M H Examine system documentation; studying to verify that authentication levels identified for different types of 

users (or processes acting on behalf of users) are implemented in a manner consistent with NIST Special 

Publication 800-63 requirements for those levels.

IA-2.1.2.3 M H Test a specific sample of information system authentication mechanisms; performing focused testing to verify 

that each authentication level is implemented as stated in information system documentation and is at least 

commensurate with the requirements in NIST Special Publication 800-63 for that level. 

APPENDIX J PAGE J-12 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE THREE: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

IA-2(1) USER IDENTIFICATION AND AUTHENTICATION

Determination 

Statement No. ASSESSMENT OBJECTIVE

IA-2(1).1 Determine if: 

IA-2(1).1.1 (i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

IA-2(1).1.2 (ii) the information system employs multifactor authentication for remote system access 

that is NIST Special Publication 800-63 compliant in accordance with the 

organizational selection of level 3, level 3 using a hardware authentication device, 

or level 4. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system security 

plan; information system design documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (M)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: IA-1. 

CONCURRENT CONTROLS: AC-14, AC-17, AU-3, IA-6, PL-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

IA-2(1).1.1.1 M Examine Identification and authentication policy and procedures; reviewing to ensure the organization defines 

the NIST Special Publication 800-63 authentication levels for the information system. 

IA-2(1).1.2.1 M Examine the information system security plan and information system design documentation; studying to 

ensure that the information system employs multifactor authentication for remote system access that is NIST 

Special Publication 800-63 compliant in accordance with the organizational selection of level 3, level 3 using a 

hardware authentication device, or level 4. 

IA-2(1).1.2.2 M Examine the information system configuration; studying to ensure the information system employs multifactor 

authentication for remote system access that is NIST Special Publication 800-63 compliant in accordance with 

the organizational selection of level 3, level 3 using a hardware authentication device, or level 4.

APPENDIX J PAGE J-13 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE THREE: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

IA-2(2) USER IDENTIFICATION AND AUTHENTICATION

Determination 

Statement No. ASSESSMENT OBJECTIVE

IA-2(2).1 Determine if: 

IA-2(2).1.1 (i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

IA-2(2).1.2 (ii) the information system employs multifactor authentication for local system access 

that is NIST Special Publication 800-63 compliant in accordance with the 

organizational selection of level 3 or level 4. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system security 

plan; information system design documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: IA-1. 

CONCURRENT CONTROLS: AC-14, AC-17, AU-3, IA-6, PL-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

IA-2(2).1.1.1 H Examine Identification and authentication policy and procedures; reviewing to ensure the organization defines 

the NIST Special Publication 800-63 authentication levels for the information system. 

IA-2(2).1.2.1 H Examine the information system security plan and information system design documentation; analyzing to 

ensure that the information system employs multifactor authentication for local system access that is NIST 

Special Publication 800-63 compliant in accordance with the organizational selection of level 3 or level 4. 

IA-2(2).1.2.2 H Examine the information system configuration; studying to ensure the information system employs multifactor 

authentication for local system access that is NIST Special Publication 800-63 compliant in accordance with 

the organizational selection of level 3 or level 4.

APPENDIX J PAGE J-14 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE THREE: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

IA-2(3) USER IDENTIFICATION AND AUTHENTICATION

Determination 

Statement No. ASSESSMENT OBJECTIVE

IA-2(3).1 Determine if: 

IA-2(3).1.1 (i) the organization defines the NIST Special Publication 800-63 authentication levels 

for the information system; and 

IA-2(3).1.2 (ii) the information system employs multifactor authentication for remote system access 

that is NIST Special Publication 800-63 level 4 compliant. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Identification and authentication policy; NIST Special Publication 800-63; 

procedures addressing user identification and authentication; information system design 

documentation; information system configuration settings and associated documentation; 

other relevant documents or records]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: IA-1. 

CONCURRENT CONTROLS: AC-14, AC-17, AU-3, IA-6, PL-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

IA-2(3).1.1.1 H Examine Identification and authentication policy and procedures; reviewing to ensure the organization defines 

the NIST Special Publication 800-63 authentication levels for the information system. 

IA-2(3).1.2.1 H Examine the information system security plan and information system design documentation; analyzing to 

ensure that the information system employs multifactor authentication for remote system access that is NIST 

Special Publication 800-63 compliant in accordance with level 4.

IA-2(3).1.2.2 H Examine the information system configuration; studying to ensure the information system employs multifactor 

authentication for remote system access that is NIST Special Publication 800-63 compliant in accordance with 

level 4.

APPENDIX J PAGE J-15 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7 BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7.1 Determine if: 

SC-7.1.1 (i) the organization defines key internal boundaries of the information system; and 

SC-7.1.2 (ii) the information system monitors and controls communications at the external 

boundary of the information system and at key internal boundaries within the 

system. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; list of key internal boundaries of the information system; information 

system design documentation; boundary protection hardware and software; information 

system configuration settings and associated documentation; other relevant documents or 

records]. (L) (M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection responsibilities]. 

(M) (H)

Test: [SELECT FROM: Information system monitoring and control of communications at the external 

boundary of the information system and at key internal boundaries within the system; automated 

mechanisms implementing boundary protection capability within the information system]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: MP-4, RA-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

SC-7.1.1.1 L M H Examine the information system security plan or system architectural documentation addressing internal 

system boundaries; reviewing for identification of key internal system boundaries for which there are to be 

protections. 

SC-7.1.2.1 L M H Examine the information system security plan or system architectural documentation addressing external 

system boundaries; reviewing for identification of all external system boundaries. 

SC-7.1.2.2 L M H Examine the information system security plan and system design and configuration documentation; reviewing 

to verify that information system boundary protections align with external and organization-defined key internal 

boundaries.

SC-7.1.2.3 L M H Examine the information boundary control monitoring documentation (e.g., intrusion detection and firewall 

logs); reviewing to verify that information system boundary protections are monitored in accordance with 

organization-defined boundary protection requirements. 

SC-7.1.2.4 M H Examine the managed boundary devices; inspecting the boundary to verify that no unauthorized devices or 

connections exist. 

SC-7.1.2.5 H Interview selected organizational personnel (technical and managerial) with boundary protection 

responsibilities; verifying their understanding of boundary protections, processes and monitoring 

responsibilities. 

SC-7.1.2.6 H Test a comprehensive sample of information system functionality for monitoring and control of communications 

at the external and key internal boundaries of the information system; determining whether approved traffic is 

allowed and unauthorized traffic is denied. 

APPENDIX J PAGE J-16 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(1) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(1).1 Determine if: 

SC-7(1).1.1 (i) the organization physically allocates publicly accessible information system 

components to separate subnetworks with separate, physical network interfaces. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

hardware and software; information system architecture; information system configuration 

settings and associated documentation; other relevant documents or records]. (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: CA-3, RA-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

SC-7(1).1.1.1 M H Examine the network architecture documentation; studying to verify that interfaces for public networks are 

physically separated from all other types of networks. 

SC-7(1).1.1.2 M H Examine information system configuration settings; studying to verify that public networks and private 

networks do not share the same interface (e.g., using ipconfig, ifconfig). 

SC-7(1).1.1.3 H Examine a representative sample of publicly accessible information system components; inspecting physical 

connectivity to verify that the components are on separate subnetworks with separate, physical network 

interfaces.

APPENDIX J PAGE J-17 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(2) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(2).1 Determine if: 

SC-7(2).1.1 (i) the organization defines the mediation necessary for public access to the 

organization’s internal networks; and 

SC-7(2).1.2 (ii) the organization prevents public access into the organization’s internal networks 

except as appropriately mediated. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; list of mediation vehicles for allowing public access to the 

organization’s internal networks; information system design documentation; boundary 

protection hardware and software; information system configuration settings and associated 

documentation; other relevant documents or records]. (M) (H)

Test: [SELECT FROM: Automated mechanisms implementing access controls for public access to the 

organization’s internal networks]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: AC-4, CA-3, RA-2. 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

SC-7(2).1.1.1 M H Examine the system security plan or other document listing the mediation necessary for allowing public access 

to the organization’s internal networks; studying to verify that mediation is defined for all public accesses 

allowed to internal networks. 

SC-7(2).1.2.1 H Test a comprehensive sample of the defined automated mediation mechanisms; performing generalized 

testing to verify that the mechanisms prevent public access into the organization’s internal networks except as 

appropriately mediated. 

APPENDIX J PAGE J-18 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(3) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(3).1 Determine if: 

SC-7(3).1.1 (i) the organization limits the number of access points to the information system to 

allow for better monitoring of inbound and outbound network traffic. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; boundary protection 

hardware and software; information system architecture and configuration documentation; 

information system configuration settings and associated documentation; other relevant 

documents or records]. (M) (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: AC-4, CA-3, RA-2, SI-4(4). 

SUCCESSOR CONTROLS: None.

Action Number Applied Potential Assessor Actions 

SC-7(3).1.1.1 M H Examine system and communications protection policy documentation, system architecture documentation, 

information system configuration control documentation, information system connection policy; reviewing to 

verify that the organization limits the number of access points. 

APPENDIX J PAGE J-19 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(4) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(4).1 Determine if: 

SC-7(4).1.1 (i) the organization defines the security controls (i.e., boundary protection devices and 

architectural configuration of the devices) appropriate at each external interface to 

a telecommunication service; and 

SC-7(4).1.2 (ii) the organization implements a managed interface with any external 

telecommunication service, implementing controls appropriate to the required 

protection of the confidentiality and integrity of the information being transmitted. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system security architecture; information system design 

documentation; boundary protection hardware and software; information system 

architecture and configuration documentation; information system configuration settings 

and associated documentation; other relevant documents or records]. (M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection responsibilities]. 

(H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: CA-3, MP-4, RA-2. 

SUCCESSOR CONTROLS: SC-8, SC-9.

Action Number Applied Potential Assessor Actions 

SC-7(4).1.1.1 M H Examine system security architecture documentation (e.g., system and communications protection policy, 

information system security plan); studying to verify that the security devices are appropriately defined at each 

external interface to a telecommunications service. 

SC-7(4).1.2.1 M H Examine system security plan or system architecture documentation; analyzing to confirm that system 

connections to external networks occur through a managed interface consisting of appropriate boundary 

protection devices arranged in effective security related architecture. 

SC-7(4).1.2.2 M H Examine the external interface of the boundary devices to the external telecommunications service(s); 

inspecting to verify that the interfaces are managed (e.g., can be turned off, can be rate limited, access control 

list is applied). 

SC-7(4).1.2.3 H Interview selected organization personnel with boundary protection responsibilities; conducting detailed 

discussions to verify that the managed interface is implemented in accordance with the defined protection 

requirements for confidentiality and integrity. 

APPENDIX J PAGE J-20 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(5) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(5).1 Determine if: 

SC-7(5).1.1 (i) the information system denies network traffic by default and allows network traffic 

by exception. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

configuration settings and associated documentation; other relevant documents or records]. 

(M) (H)

Interview: [SELECT FROM: Selected organizational personnel with boundary protection responsibilities]. 

(H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: AC-4, CA-3, RA-2. 

SUCCESSOR CONTROLS: CM-7.

Action Number Applied Potential Assessor Actions 

SC-7(5).1.1.1 M H Examine system security documentation; reviewing to verify that it specifically states what protocols/services 

are allowed through the external interface that it supports and that all others are prohibited and/or disabled by 

default. 

SC-7(5).1.1.2 M H Examine specific sample of boundary protection devices for configuration settings such as access control lists, 

firewall and proxy server settings; inspecting to verify that only authorized network traffic is being allowed 

through the external boundary interfaces. 

SC-7(5).1.1.3 H Interview a specific sample of organizational personnel with boundary protection responsibilities; conducting 

focused discussions to determine whether the information system is consistently being configured to deny 

network traffic by default and allow network traffic by exception. 

APPENDIX J PAGE J-21 
Special Publication 800-53A Guide for Assessing the Security Controls in Federal Information Systems 

________________________________________________________________________________________________ 

APPENDIX J PAGE J-22 

EXAMPLE FOUR: ASSESSMENT CASE FOR TECHNICAL SECURITY CONTROL 

ASSESSMENT CASE

SC-7(6) BOUNDARY PROTECTION

Determination 

Statement No. ASSESSMENT OBJECTIVE

SC-7(6).1 Determine if: 

SC-7(6).1.1 (i) the organization prevents the unauthorized release of information outside of the 

information system boundary or any unauthorized communication through the 

information system boundary when there is an operational failure of the boundary 

protection mechanisms. 

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: System and communications protection policy; procedures addressing 

boundary protection; information system design documentation; information system 

configuration settings and associated documentation; information system audit records; 

other relevant documents or records]. (H)

Test: [SELECT FROM: Automated mechanisms supporting the fail-safe boundary protection capability 

within the information system]. (H)

RELATED CONTROL INFORMATION 

PRECURSOR CONTROLS: None.

CONCURRENT CONTROLS: AC-4, CA-3, CP-2, CP-4, RA-2. 

SUCCESSOR CONTROLS: CM-7.

Action Number Applied Potential Assessor Actions 

SC-7(6).1.1.1 H Examine system documentation such as the system security plan and contingency plan; analyzing to verify 

that the organization prevents the unauthorized release of information outside of the information system 

boundary or any unauthorized communication through the information system boundary when there is an 

operational failure of the boundary protection mechanisms. 

SC-7(6).1.1.2 H Test a comprehensive sample of the failsafe boundary protection mechanisms; performing generalized testing 

(for example, by utilizing sniffers, proxy software, or other tools available to capture network traffic on the 

external boundary interface) to verify that unauthorized release of information outside of the information system 

boundary is not being passed during the operational failure of the boundary protection mechanism.