NIST 800-53 r5 · Controls catalogue · Family CA

CA-2Control Assessments

Select the appropriate assessor or assessment team for the type of assessment to be conducted; Develop a control assessment plan that describes the scope of the assessment including: Controls and control enhancements under assessment; Assessment procedures to be used to determine control effectiveness; and Assessment environment, assessment team, and assessment roles and responsibilities; Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; Assess the controls in the system and its environment of operation {{ insert: param, ca-02_odp.01 }} to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements; Produce a control assessment report that document the results of the assessment; and Provide the results of the control assessment to {{ insert: param, ca-02_odp.02 }}.

Last updated: 22 August 2026 07:11 UTC

Implementations targeting this control (0)

No implementations targeting this control yet.

ATT&CK techniques this control mitigates (5)

T1190 Exploit Public-Facing Application Initial Access
T1195 Supply Chain Compromise Initial Access
T1195.001 Compromise Software Dependencies and Development Tools Initial Access
T1195.002 Compromise Software Supply Chain Initial Access
T1210 Exploitation of Remote Services Lateral Movement

Weaknesses this control addresses (8)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-862`	Missing Authorization	10,200+	Control assessments determine if authorization is enforced for functions and resources, detecting missing authorization weaknesses.
`CWE-284`	Improper Access Control	6,900+	Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.
`CWE-287`	Improper Authentication	5,200+	Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
`CWE-863`	Incorrect Authorization	3,900+	The assessment evaluates authorization logic and enforcement, identifying incorrect authorization that could be exploited.
`CWE-306`	Missing Authentication for Critical Function	3,300+	The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
`CWE-732`	Incorrect Permission Assignment for Critical Resource	1,900+	Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
`CWE-693`	Protection Mechanism Failure	700+	Direct evaluation of whether controls produce desired security outcomes detects protection mechanism failures and enables remediation.
`CWE-358`	Improperly Implemented Security Check for Standard	100+	Assessments identify and document improperly implemented security checks, allowing fixes that reduce exploitation of flawed checks.

Top CVEs where this control is the strongest mitigation

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.

Other controls in family CA

CA-1 CA-3 CA-4 CA-5 CA-6 CA-7 CA-8 CA-9