Assessment, Authorization, and Monitoring¶

• a. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
• b. Develop a control assessment plan that describes the scope of the assessment including:
  • 1. Controls and control enhancements under assessment;
  • 2. Assessment procedures to be used to determine control effectiveness; and
  • 3. Assessment environment, assessment team, and assessment roles and responsibilities;
• c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• d. Assess the controls in the system and its environment of operation [Assignment: organization-defined assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
• e. Produce a control assessment report that document the results of the assessment; and
• f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].

Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:

• a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
• b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
• c. Ongoing control assessments in accordance with the continuous monitoring strategy;
• d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
• e. Correlation and analysis of information generated by control assessments and monitoring;
• f. Response actions to address results of the analysis of control assessment and monitoring information; and
• g. Reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined system(s) or system components].