NIST 800-171 Controls · Security Assessment
CA.2.001 — Periodically Assess Security Controls
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
What CA.2.001 means in plain English
At least once a year, go through all 110 NIST controls and honestly check whether each one is actually working — not just whether you wrote a policy, but whether people are following it. Is your password policy enforced, or is everyone still using "password123"? Are your backups actually running, or did they silently fail three months ago? This self-assessment is how you find gaps before an assessor does.
The assessment question
“Do you conduct at least an annual self-assessment of all NIST SP 800-171 security controls to verify they are implemented and operating effectively, and do you document the results?”
How to implement CA.2.001
- Download the NIST SP 800-171A assessment guide (free) which provides specific assessment procedures for each control. Use this as your checklist.
- Schedule an annual security control assessment — block out 2-3 days on your calendar. Walk through each of the 110 controls with evidence in hand.
- For each control, record a status (Met / Partially Met / Not Met) and supporting evidence. Use a spreadsheet or a tool like Vanta to track this.
- Any controls rated Partially Met or Not Met should be added to your POA&M with planned remediation actions, responsible parties, and deadlines.
- Have someone other than the person who implemented a control verify its effectiveness when possible — fresh eyes catch things.
Evidence your assessor will ask for
- Completed annual self-assessment report showing status of all 110 controls
- Evidence of assessment methodology used (NIST 800-171A or equivalent)
- Assessment findings log with control-by-control status and supporting evidence references
- POA&M entries for any controls found to be partially met or not met
- Evidence that assessments are performed at least annually (dates on reports)
Does AI prompt monitoring help with this control? Honestly, no.
CA.2.001 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Security Assessment controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.