United States (federal) · federal standard
NIST 800-53 · CA: what it requires, and the records to keep
The CA family has 9 controls (CA-1 to CA-9, CA-4 withdrawn) covering control assessments, plans of action, authorization to operate, continuous monitoring and penetration testing. For AI systems in federal use it is how an authorizing official accepts risk before deployment and keeps checking controls after go-live.
01 / What it requires
What NIST 800-53 · CA requires
Federal agencies and the contractors and cloud providers that operate federal information systems under FISMA, FedRAMP or contract terms.
- 01Plan and run control assessments with an appropriate assessor and report results (CA-2).
- 02Track weaknesses and remediation in a plan of action and milestones, updated from assessments and monitoring (CA-5).
- 03Have a senior authorizing official authorize the system before operation and update authorizations (CA-6).
- 04Run continuous monitoring with defined metrics, frequencies and ongoing control assessments (CA-7).
- 05Conduct penetration testing on defined systems or components at a defined frequency (CA-8).
- 06Approve and document information exchanges and internal system connections (CA-3, CA-9).
02 / AI work
Where it touches AI work
Applies to AI systems as to any system. An AI capability must fall within an assessed and authorized boundary, and continuous monitoring is where changes such as new model versions are tracked.
03 / Dates
The dates that matter
SP 800-53 Rev. 5 published
Rev. 5 Update 1 published
NIST concept paper on 800-53 control overlays for AI systems
Release 5.2.0 published (software update controls)
Annotated outline for predictive AI overlay released
AI overlay project renamed Control Overlays for Super Intelligence Systems
04 / Enforcement
Who enforces it
Agency authorizing officials, inspectors general and OMB under FISMA; FedRAMP for cloud services. No fines; systems without authorization should not operate.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Security assessment plan and assessment report
- 02Plan of action and milestones (POA&M)
- 03Authorization to operate (ATO) decision letter
- 04Continuous monitoring strategy and periodic monitoring reports
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
NIST Computer Security Resource Center
NIST (usnistgov/oscal-content)
NIST Computer Security Resource Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST 800-53 · CA for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4