id: "CA-07(01)" title: "Independent Assessment" family: "CA" family_name: "Assessment, Authorization, and Monitoring" sort_id: "ca-07.01" priority: "P1" implementation_level: "organization" parent: "CA-07" enhancement: True
Statement
Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.
Guidance
Organizations maximize the value of control assessments by requiring that assessments be conducted by assessors with appropriate levels of independence. The level of required independence is based on organizational continuous monitoring strategies. Assessor independence provides a degree of impartiality to the monitoring process. To achieve such impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in advocacy positions for the organizations acquiring their services.
Assessment Objective
independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.
Assessment, authorization, and monitoring policy
organizational continuous monitoring strategy
system-level continuous monitoring strategy
procedures addressing continuous monitoring of system controls
control assessment report
plan of action and milestones
system monitoring records
impact analyses
status reports
system security plan
privacy plan
other relevant documents or records
Organizational personnel with continuous monitoring responsibilities
organizational personnel with information security and privacy responsibilities