| 💼 CA-1 Policy and Procedures (L)(M)(H) | | | | |
| 💼 CA-2 Control Assessments (L)(M)(H) | 3 | | | |
| 💼 CA-2(1) Independent Assessors (L)(M)(H) | | | | |
| 💼 CA-2(2) Specialized Assessments (H) | | | | |
| 💼 CA-2(3) Leveraging Results from External Organizations (M)(H) | | | | |
| 💼 CA-3 Information Exchange (L)(M)(H) | 1 | | | |
| 💼 CA-3(6) Transfer Authorizations (H) | | | | |
| 💼 CA-5 Plan of Action and Milestones (L)(M)(H) | | | | |
| 💼 CA-6 Authorization (L)(M)(H) | | | | |
| 💼 CA-7 Continuous Monitoring (L)(M)(H) | 2 | | 8 | |
| 💼 CA-7(1) Independent Assessment (M)(H) | | | | |
| 💼 CA-7(4) Risk Monitoring (L)(M)(H) | | | | |
| 💼 CA-8 Penetration Testing (L)(M)(H) | 2 | | | |
| 💼 CA-8(1) Independent Penetration Testing Agent or Team (M)(H) | | | | |
| 💼 CA-8(2) Red Team Exercises (M)(H) | | | | |
| 💼 CA-9 Internal System Connections (L)(M)(H) | | | | |