# NIST SP 800-53 Rev. 5 CA-2(3) — Leveraging Results From External Organizations - Source: https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ca-2-3-leveraging-results-from-external-organizations - Section: [Compliance](https://support.icompaas.com/compliance) › [NIST SP 800-53 Rev. 5 Controls](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5) › CA — Assessment, Authorization, and Monitoring - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **NIST SP 800-53 Rev. 5**·Control `CA-2(3)`·medium·Component: **Assessment, Authorization, and Monitoring** ## What this control requires > Leverages external organization assessment results meeting defined requirements to reduce redundant assessments and costs. This control supports the External Assessment Repository capability within the Assessment, Authorization, and Monitoring family. > > — NIST SP 800-53 Rev. 5, Control CA-2(3) ### In plain English Leverages external organization assessment results meeting defined requirements to reduce redundant assessments and costs. In practice, this means you can prove you review management-level controls on a defined cadence. ## Why it matters SP 800-53 is the catalogue every U.S. federal authorisation (FedRAMP, FISMA, CMMC) and most regulated industries point at. A missing control surfaces as a Plan of Action & Milestones (POA&M) item that an Authorizing Official must approve before the Authority To Operate is granted or renewed. ## What an auditor looks for A 3PAO (FedRAMP) or Independent Assessor (NIST RMF) tests against NIST SP 800-53A assessment procedures. For each control they expect a documented implementation that addresses every assessment objective (Examine, Interview, Test) and an implementation summary in the System Security Plan. Within **Assessment, Authorization, and Monitoring**, the assessor will trace your implementation back to the catalogue reference (Control CA-2(3)) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Secure Development **Pipeline.** Require code review, SAST (Semgrep / Snyk Code), SCA (Dependabot / Renovate), secret-scanning and IaC scanning in the merge pipeline. **Branch protection.** Protected branches enforce reviews, signed commits and passing CI before merge; document the protection rules as the control evidence. #### Code Review Testing **Pipeline.** Require at least one human reviewer plus passing CI (lint, type, unit, security scan) before merge — protected branches enforce this. #### Vulnerability Management **Scanners.** Pair an unauthenticated scanner (Nessus / Qualys / Tenable.io) for external surface with an authenticated agent for OS/library CVEs on every host. **SLA.** Document remediation SLAs by CVSS / EPSS: critical 7 days, high 30 days, medium 90 days; report monthly trend to leadership. **Containers.** Scan images in CI (Trivy / Grype / Snyk Container) AND at runtime; block deploys on critical findings without exception. ### Operational checklist - **Review.** Document the trigger, the owner and the cadence. - **Control.** Document the trigger, the owner and the cadence. - **Authorization.** Document the trigger, the owner and the cadence. - **Testing,.** Document the trigger, the owner and the cadence. - **Code.** Document the trigger, the owner and the cadence. - **Scope:** management, authorization, organization, repository, assessments, assessment, review, capability. ## Evidence to collect - **Code Repo Scan.** Source-control evidence — branch protection, required reviewers, CI status, SCA / SAST reports. Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Leveraging Results From External Organizations. ## Common pitfalls - CI security checks set to warn-only; the merge button is faster than the security feedback. - Scans that hit only the perimeter; missing authenticated scans of OS, runtime libs and base images so most CVEs are invisible. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**BSI C5:2020 DEV-08** — Version Control](https://support.icompaas.com/compliance/bsi-c5-2020/dev-08-version-control) - [**CIS Controls v8 16.13** — Conduct Application Penetration Testing](https://support.icompaas.com/compliance/cis-controls-v8/16-13-conduct-application-penetration-testing) ## Related controls in NIST SP 800-53 Rev. 5 - [**Control RA-5(11)** — Public Disclosure Program](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ra-5-11-public-disclosure-program) - [**Control CA-8(1)** — Independent Penetration Testing Agent Or Team](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ca-8-1-independent-penetration-testing-agent-or-team) - [**Control CA-7** — Continuous Monitoring](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ca-7-continuous-monitoring) - [**Control SA-11(9)** — Interactive Application Security Testing](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/sa-11-9-interactive-application-security-testing) - [**Control SA-15(7)** — Automated Vulnerability Analysis](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/sa-15-7-automated-vulnerability-analysis) - [**Control RA-4** — Risk Assessment Update](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ra-4-risk-assessment-update) ## References - [NIST Computer Security Resource Center — NIST SP 800-53 Rev. 5](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls) - Catalogue identifier: `Control CA-2(3)` Topics: secure developmentcode review testingdevsecopsvulnerability management ## Related compliance guidance - [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): Start with the full NIST SP 800-53 implementation guide — scope, roadmap, evidence and how the assessment runs. - [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If your obligation is protecting CUI in your own systems for a federal or defence contract, this derived subset — not the full catalogue — is the requirement. - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most commercial SaaS already hold a SOC 2 Type 2, and FedRAMP 20x Class A is designed for providers that have one.