CA-4 (Security Certification) no longer exists as an active control in NIST SP 800-53 Rev 5. The OSCAL catalog marks it withdrawn and incorporated into CA-2, Control Assessments.
What changed
Older revisions treated certification as a separate step. Rev 5 absorbed it into the assessment control, so the work is the same and the number is not. There is nothing to implement under CA-4.
What it means in practice
If an older policy or questionnaire cites CA-4, answer with your CA-2 evidence: the assessment plan, the assessor, the report and the results shared with decision makers.
Be careful with the word certification. A report from an assessor is not a formal certificate of anything unless a recognized body issued one. Describe what you have accurately.
Evidence to collect
- The CA-2 assessment plan and report.
- Assessor identity and independence.
- Proof results reached the authorizing person.
Common gaps
- Citing CA-4 in policies, which dates the document.
- Calling an internal assessment a certification.
Sources
- NIST SP 800-53 Rev 5, CA-4 on the NIST CPRT catalog
- NIST SP 800-53 Rev 5 publication
- Withdrawn status and incorporation into CA-2: OSCAL catalog, NIST SP 800-53 Rev 5.2.0
