However, NIST SP 800–37 has some limitations, such as authorization boundaries that need continuous updating to account for high-risk systems that may have been missed. Additionally, there is a lack of RMF/Security Assessment and Authorization (SA&A) maturity model, which would provide metrics of effectiveness.