Security Assessment and Authorization (CA) Security Baselines Control Control Name/Requirement Number Low High Security Assessments Security Assessments CA-2 Risk Management Framework X X X to CITR-019: (RMF) for control details. Specialized Assessments CA-2.2 X Risk Management Framework Refer to CITR-019: (RMF) for control details. Information and System Connections Information and System Connections Risk Management Framework to CITR-019: (RMF) for control details. CA-3 X X X The DOC requires OUs to review and DOC Criteria: update Interconnection Security Agreements at annually and update as necessary. Plan of Action and Milestones Plan of Action and Milestones CA-5 X X X IT Security Plans of Action and Refer to CITR-018: Milestones (POA&M) for control details. Security Authorization Security Authorization CA-6 X X X Risk Management Framework to CITR-019: (RMF) for control details. Continuous Monitoring Continuous Monitoring Enhancing the Security of Refer to OMB M-14-03: CA-7 X X X Federal Information and Information Systems and Risk Management Framework (RMF) CITR-019: for control details. Independent Assessment CA-7.1 X X Risk Management Framework to CITR-019: (RMF) for control details. Penetration Testing Penetration Testing CA-8 X Penetration testing must be conducted at annually as part of annual assessment. Configuration Management (CM)
Security Assessment and Authorization (CA) Control Number Control Name/Requirement Security Baselines Low High Security Assessments CA-2 Security Assessments to CITR-019: Risk Management Framework (RMF) for control details. X X X CA-2.2 Specialized Assessments Refer to CITR-019: Risk Management Framework (RMF) for control details. X Information and System Connections CA-3 Information and System Connections to CITR-019: Risk Management Framework (RMF) for control details. DOC Criteria: The DOC requires OUs to review and update Interconnection Security Agreements at annually and update as necessary. X X X Plan of Action and Milestones CA-5 Plan of Action and Milestones Refer to CITR-018: IT Security Plans of Action and Milestones (POA&M) for control details. X X X Security Authorization CA-6 Security Authorization to CITR-019: Risk Management Framework (RMF) for control details. X X X Continuous Monitoring CA-7 Continuous Monitoring Refer to OMB M-14-03: Enhancing the Security of Federal Information and Information Systems and CITR-019: Risk Management Framework (RMF) for control details. X X X CA-7.1 Independent Assessment to CITR-019: Risk Management Framework (RMF) for control details. X X Penetration Testing CA-8 Penetration Testing Penetration testing must be conducted at annually as part of annual assessment. X Configuration Management (CM)