Having a control and having a control that works are different things. CA-2 is where you prove the second one.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference, and a good model for internal audit or readiness work before an external audit.
What the control asks
CA-2 has six steps. Select an appropriate assessor or assessment team. Develop a control assessment plan covering the controls and enhancements under assessment, the procedures used to judge effectiveness, and the environment, team and roles. Have the plan reviewed and approved by the authorizing official or designee before assessing. Assess the controls, at a frequency you define, to determine whether they are implemented correctly, operating as intended and producing the desired outcome. Produce an assessment report. Provide the results to defined individuals or roles.
What it means in practice
NIST's guidance stresses that assessors need the right skills, including risk management and knowledge of the technology. Assessments feed initial and ongoing authorization, continuous monitoring, design and development and more.
Three enhancements matter: CA-2.1 Independent Assessors, CA-2.2 Specialized Assessments and CA-2.3 Leveraging Results from External Organizations. The last one is useful for small companies: a recent third party report can reduce what you retest.
Note that CA-4 Security Certification was withdrawn and incorporated into CA-2.
For a company that is not federal, the authorizing official becomes whoever accepts risk for the system, usually a CTO or CISO. Say so in the plan.
Evidence to collect
- An assessment plan with scope, procedures and roles, and its approval.
- Assessor qualifications or independence statement.
- The assessment report with results per control.
- Test artifacts: queries, screenshots, exports and sampled records.
- Distribution record showing who received results.
- Links from findings to remediation tickets, which feed CA-5.
Common gaps
- Self assessment by the team that built the control, with no independence.
- No plan, so scope is unclear.
- Results checked by reading policy rather than testing operation.
- Reports with no owner for findings.
- One time assessments with no repeat.
How to implement it
Choose the controls in scope, and write test steps for each. Ask what evidence proves it works: a sample of access reviews, a restore test, a sample of closed vulnerabilities with dates. Assign an assessor who did not run the control. Approve the plan, run it, write up results and open tickets.
Collecting evidence by hand each cycle is slow. See how evidence collection can be automated in the demo.
Click through it at your own pace, or open it full screen.
Repeat on a schedule that matches risk. Critical controls get tested more often than low risk ones.
Quick check
Can the same team test its own control?
It can for internal checks, but CA-2.1 Independent Assessors exists because independence makes findings more credible. Use someone outside the control's operation for anything you show a customer.
Where did CA-4 go?
It was withdrawn and incorporated into CA-2.
