Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans

Published

Author(s)

Ronald S. Ross, L A. Johnson

Abstract

[Superseded by SP 800-53A Rev. 4 (December 2014): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=917644] Special Publication 800-53A, Revision 1 provides guidelines for developing security assessment plans and associated security control assessment procedures that are consistent with Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, August 2009 (including updates as of 05-01-2010). NIST has been working in partnership with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DOD), and the Committee on National Security Systems (CNSS) to develop a common information security framework for the federal government and its contractors. The updated security assessment guideline incorporates best practices in information security from the United States Department of Defense, Intelligence Community, and Civil agencies and includes security control assessment procedures for both national security and non national security systems. The guideline for developing security assessment plans is intended to support a wide variety of assessment activities in all phases of the system development life cycle including development, implementation, and operation. The important changes described in Special Publication 800-53A, Revision 1, are part of a larger strategic initiative to focus on enterprise-wide, near real-time risk management. The increased flexibility in the selection of assessment methods, assessment objects, and depth and coverage attribute values empowers organizations to place the appropriate emphasis on the assessment process at every stage in the system development life cycle. [Supersedes NIST SP 800-53A (July 2008): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=51209]
Citation
Special Publication (NIST SP) - 800-53A Rev 1
Report Number
800-53A Rev 1

Keywords

assurance requirements, attributes, categorization, FISMA, NIST SP 800-53, risk management, security assessment plans, security controls
Created June 29, 2010, Updated February 19, 2017