Assess, authorize, monitor, and generate reports

  • Release version: Washingtondc
  • Updated August 1, 2024
  • 2 minutes to read

    • After you have completed the implementation process, you can assess internal and external controls, generate Plans of Action and Milestones (POA&M), and manage change requests and vulnerable items.

    Before you begin

    Role required:
    • sn_irm_cont_auth.system_owner
    • sn_irm_cont_auth.info_system_sec_officer
    • sn_irm_cont_auth.authorization_official
    • sn_irm_cont_auth.info_system_sec_manager
    • sn_irm_cont_auth.admin

    About this task

    The Assess process is generally performed by a user other than the system owner or the personnel who implemented the controls.
    The Assess state adds Control Assessments and Risk Summary related lists, as well as POA&M, Change Requests, Security Incidents, and Vulnerable Items tabs to the Authorization Package form.
    Note:
    Performance issues have been observed in the Continuous Authorization & Monitoring application when a high volume of Change Request, Incident records, or both is related to a single Authorization Package. If you experience long transaction response times, consider performing the workarounds detailed in KB0861865.

    Procedure

    1. For an Authorization Package in the Implement state, select Assess.
      Transition to the Assess state
      Note:
      An Audit Engagement is automatically created.

      To send the package back to the Implement state, select Back to previous step. The state of the engagement becomes Closed Incomplete. On selecting the Assess button, an engagement is created.

    2. Select the Control Assessments related list to view the Audit engagement.
      Control Assessments
      Note:
      The Audit Engagement is automatically assigned to the SCA.
    3. Select the engagement number to open it.

      Notice that the Entities tab is displaying the authorization boundary for the package.

      Tabs for assessment.
    4. Select the Controls tab to view all the controls that your team implemented.
      Controls
    5. Select the Test plans tab.
      Test plans are automatically created for the control. For more information on test plans, see Generate assessment procedure plans for a test plan.
    6. Select the Control tests tab to view the tasks for assessing the controls.
      Note:
      Audit tasks tab in the Default view is renamed as Control tests tab in the CAM view. The names of the related list labels vary and are specific to the view that you select, which is either Default view or CAM view. You can change the view by selecting the Additional actions icon (Additional actions menu icon.), select CAM from the View list.

      Control tests tab.

      For more information on test plans, see Determine control effectiveness of a control test.

      1. Select a control test.

        Assessment procedures related list.

      2. From the Assessment procedures list, select a record.
      3. Select the Attach File link to attach an evidence document as a proof of the test.
      4. Select the Notes field to enter additional assessment details.

        Assessment procedure record view.

    7. In the Default view, select an audit task and perform the Design Test and Operation Test to judge the control's effectiveness.

      For details on this process, see Manage engagements.

      Note:
      Any issues that arise during the Assess phase appear in the POA&M tab. Additionally, any open Change Requests or Vulnerable Items targeting the system elements in the package appear under those tabs.
    8. The system owner must review and document any POA&M issues, change requests, and vulnerable items that potentially threaten your systems.
    9. When the review is complete, select Authorize.
      Note:
      In the Monitor state, continuous monitoring is achievable if you have indicators. If not, you can manually review the controls. For more information, see Manage control indicators.

      You can select the Generate Report(s) button to generate a FedRAMP System Security Plan (SSP) document for the authorization package in PDF format.

      The package transitions to the Authorize state. When you’re satisfied that all is in order, select Request Approval. An approval request is sent to the Authorizing Official, who will access My Approvals from the navigation pane and review the information in the package. When the approval is received, the package transitions to the Monitor state.