Assessment, Authorization, and Monitoring (CA) templates
Templates for the Assessment, Authorization, and Monitoring (CA) family of controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, with the family policy and procedure first.
- Assessment, Authorization, and Monitoring PolicyPOL-CA
In this policy, the CISO sets the Organization's requirements for assessment, authorization, and monitoring in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Assessment, Authorization, and Monitoring ProcedurePROC-CA
The people named in this procedure use it to carry out the CA control family policy (POL-CA). It covers every control in the assessment, authorization, and monitoring family.
- CUI Waivers and Self-Inspection ProcedurePROC-CUI-005
Use this procedure to ask for, decide, record, and end waivers of CUI requirements, and to run the yearly self-inspection and report to ISOO. It covers every part of the CUI program.
- Plan of Action and Milestones (POA&M) Management ProcedurePROC-POAM-001
The Information System Security Officer (ISSO) uses a POA&M item to track one weakness. The item states what is wrong, the risk it poses, the corrective action, the resources needed, the owner, and the milestones to closure. Authorizing Officials use POA&M data for risk decisions.
- Information Security Continuous Monitoring (ISCM) StrategyPLAN-ISCM-001
- Interconnection and Information Exchange Agreement TemplatesTMPL-ISA-001
This agreement sets the terms, conditions, and protections for the exchange of _[information types]_ between _[Organization A]_ and _[Organization B]_.