CA-2 (3) CA-2 (3) blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. obtains and examines a Therefore, sampling of records of this AP is not acceptance or rejection applicable. of external organization assessment results to ensure the organization inspected/assessed accepts the results of an assessment of the information system defined in CA-2 (3), CCI 2067 performed by external organization defined in CA-2 (3), CCI 2068 when the assessment meets requirements defined in CA-2 (3), CCI 2069. CA-2 CA-2 (a) High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the Security Plan to validate *security assessment blocks* are complete. CA-2 CA-2 (a) (1) High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains the security assessment plan to verify the plan identifies the security controls and those control enhancements under assessment.
CA-2 (3) CA-2 (3) blank blank The organization conducting the inspection/assessment obtains and examines a sampling of records of acceptance or rejection of external organization assessment results to ensure the organization inspected/assessed accepts the results of an assessment of the information system defined in CA-2 (3), CCI 2067 performed by external organization defined in CA-2 (3), CCI 2068 when the assessment meets requirements defined in CA-2 (3), CCI 2069. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-2 CA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the Security Plan to validate *security assessment blocks* are complete. CA-2 CA-2 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains the security assessment plan to verify the plan identifies the security controls and those control enhancements under assessment.
RMF_Security-Assessment-and-Authorization-Plan.docx