CA-2—Control Assessments

>Control Description

Select the appropriate assessor or assessment team for the type of assessment to be conducted;

Develop a control assessment plan that describes the scope of the assessment including:

Controls and control enhancements under assessment;

Assessment procedures to be used to determine control effectiveness; and

Assessment environment, assessment team, and assessment roles and responsibilities;

Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;

Assess the controls in the system and its environment of operation ⚙organization-defined frequency to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;

Produce a control assessment report that document the results of the assessment; and

Provide the results of the control assessment to ⚙organization-defined individuals or roles.