# NIST800 53 CA-2 — Control Assessments

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_ca2_ce5a9bc1e4-nist800-53-ca-2-control-assessments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Assessment, Authorization, and Monitoring](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_assessmentauthorizationandmonitoring)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control CA-2 · Priority: high · Component: Assessment, Authorization, and Monitoring

### What this control covers

Selects assessors, develops and approves assessment plans, assesses controls periodically, and provides results to designated personnel for risk-based decisions. This control supports the Assessment Management System capability within the Assessment, Authorization, and Monitoring family.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

**VM Manager** (OS patch + config management) and **Artifact Registry vulnerability scanning** integrate with Cloud Build to block vulnerable images.

#### GitHub

**Dependabot** security updates + version updates, plus **CodeQL** for SAST and a renovate bot for major-version drift management.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Control Assessments.

### Quick checklist

-   Policy — Management / Authorization
-   System — Management / Authorization
-   Control — Management / Authorization
-   Authorization — Management / Authorization
-   Vulnerability — Management / Authorization
-   Risk — Management / Authorization

### Related articles on this site

-   [Ensure Diagnostic Setting captures appropriate categories from the control/management plane](https://support.icompaas.com/support/solutions/articles/62000219824--ensure-diagnostic-setting-captures-appropriate-categories-from-the-control-management-plane)
-   [Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account](https://support.icompaas.com/support/solutions/articles/62000219830-ensure-that-vulnerability-assessment-va-is-enabled-on-a-sql-server-by-setting-a-storage-account)
-   [Vulnerability Management Procedure](https://support.icompaas.com/support/solutions/articles/62000225139-vulnerability-management-procedure)
-   [Acquisition Risk Management](https://support.icompaas.com/support/solutions/articles/62000225148-acquisition-risk-management)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.