NIST SP 800-53A

NIST Special Publication 800-53A provides guidance for assessing the security controls defined in SP 800-53. It describes the methods, procedures, and depth of assessment for each control — essentially telling assessors how to test whether your security controls actually work.

For each control, 800-53A defines assessment objectives (specific things to verify), assessment methods (examine, interview, test), and assessment objects (what to look at — documents, people, or systems). This publication is what Security Control Assessors use to structure their evaluations.