Cyber · Trackr The Free Compliance Library
⌘K
CA · Plan wizard

Assessment, Authorization, and Monitoring Plan

Documents how the system is assessed for control effectiveness, authorized for operation, and continuously monitored. Covers the controls of the CA family in NIST SP 800-53 r5 and aligns with NIST SP 800-37 r2 (RMF), NIST SP 800-53A r5 (Assessment), NIST SP 800-137 (Continuous Monitoring), NIST SP 800-47 r1 (Information Exchange), and NIST SP 800-115 (Penetration Testing).

1 System metadata
Full official name of the information system.
Short identifier used in headings and references.
Role or named individual accountable for the system.
Describe what falls inside the authorization boundary - components, services, networks, data flows.
2 Baseline
Determines which controls in this family appear in your plan.
3 Assessment, Authorization, and Monitoring approach
Approach basics → §4.x

Authorization type, who assesses, who authorizes, the ConMon framework.

Role that holds authorization decision authority (e.g., 'Department CIO', 'Program AO', 'Designated Approving Authority'). Use the role title, not a named individual.
Who performs control assessments (e.g., 'Independent Internal Audit team', 'Third-party 3PAO', 'In-house ISSO with peer review', 'FedRAMP-accredited 3PAO').
When the current authorization was granted.
Traditional 3-year cycle, or 'Ongoing' for continuous-authorization regimes.
Authoritative ConMon strategy document (e.g., 'Org ConMon Strategy v2.1', 'FedRAMP ConMon Strategy & Guide', 'NIST SP 800-137 derived plan').
Control Assessment Strategy (CA-2) → §4.x

Assessment methodology, scope per cycle, and reporting.

If not all controls assessed every cycle: how the subset is selected (risk-based, rotation, ConMon-driven). Reference NIST SP 800-53A r5 §3 for guidance.
Who receives the Security Assessment Report (System Owner, AO, ISSO, ISSM, audit committee). Distribution control given the SAR contains finding details.
Information Exchange (CA-3) → §4.x

External system connections, ISAs / MOUs / IAs, and ongoing review.

Where the inventory of external system connections is maintained (e.g., 'Boundary diagram in SSP §4.2 + ISA register in Confluence'). The inventory drives this group.
How agreements are negotiated, approved (by AO), tracked, and reviewed. Reference NIST SP 800-47 r1 for federal interconnection guidance.
How a connection is properly torn down when no longer needed (network rules removed, access revoked, ISA formally terminated).
Plan of Action and Milestones (CA-5) → §4.x

POA&M tooling, lifecycle, and SLAs.

System holding POA&M items (e.g., 'eMASS', 'Xacta 360', 'CSAM', 'ServiceNow GRC', 'Confluence + Jira tracker').
How long POA&M items can stay open by severity. Federal references: BOD 22-01 for KEVs (15-30 days), FedRAMP for non-KEV (Critical 30 / High 90 / Medium 180). Adapt to your authority.
When can a POA&M item be closed by risk acceptance rather than remediation? Who must concur? What documentation is required?
How a POA&M item is validated as closed (re-test by assessor, ISSO sign-off, automated re-scan). Independent validation requirement.
Authorization Process (CA-6) → §4.x

How authorization decisions are made and documented.

Step-by-step from package submission to AO decision. SCA review → ISSM concurrence → AO decision → ATO letter issued.
Conditions that trigger AO consideration of DATO (Denial of ATO) or revocation: critical unaddressed POA&Ms, high-impact incident, compliance violation.
When and how IATT (Interim Authority to Test) is used for development / test environments before full ATO. Time-bound, scope-limited.
Continuous Monitoring Strategy (CA-7) → §4.x

The strategy that every other family plan's §7 references back to.

What constitutes a 'material change' that requires AO notification or re-assessment of authorization (significant architecture change, scope expansion, new data category, control failure trend).
Where the live ConMon dashboard lives (Splunk, Tableau, eMASS, custom).
How long ConMon-derived evidence (scan results, audit-trail snapshots) is retained for re-authorization use.
Penetration Testing (CA-8) → §4.x

Pen-test scope, frequency, and reporting.

Where the ROE document lives (defines scope, timing, prohibited actions, escalation contacts).
Who receives the report, how it's stored, and how findings flow into the POA&M. Reports often warrant tighter access controls than other documentation.
Internal System Connections (CA-9) → §4.x

Connections within the authorization boundary that warrant explicit authorization.

Connections between distinct components within the boundary (DMZ→app tier→DB; admin VLAN→production; jump-host→target). Many systems document these in a network diagram + flow table.
How each internal connection is authorized — usually via the architecture-decision record reviewed by the CCB at design time, then enforced by network policy / security groups.
Assessment Scope and Boundary → §2.x

What's in scope for assessment, in plain terms.

Total controls + enhancements applicable to the chosen baseline.
Approximate count of distinct external connections (each typically requires an ISA / IA).
Brief enumeration of data categories the system handles (informs assessment depth — PII / PHI / classified data warrant heightened assessment).
Published ConMon Metrics → §6.x

Specific metric values reported to the AO.

    Suggested:
    ConMon Review Cadence → §6.x

    How and when ConMon outputs drive decisions.

    What decisions are made at review (POA&M reprioritization, risk acceptance, AO escalation, plan revisions).
    Cross-references to other RMF artifacts → §7

    This plan is the integration hub — it both references and is referenced by every other plan.

    Where in the SSP the CA control implementations are summarized (e.g., 'SSP §13.2').
    Convention for CA-related POA&M items (e.g., 'POAM-CA-').
    List the family plans that feed CA: CM, AC, AU, IA, IR, CP, SI plus any others. Each plan's CA-7 ConMon section ties back to this plan.
    Where the current RAR lives. Authoritative input to the AO's decision.
    Role responsible for keeping the SSP current (typically ISSO).
    4 Per-control implementation

    Pick a baseline in section 2 and the applicable controls will appear here. Each control gets a card with the official text, related controls, linked CCIs, and fields for your implementation status, narrative, responsible role, and evidence.

    5 Document metadata

    Your answers autosave to this browser. Click Save progress to download a JSON file you can re-upload later or share.