Identify and discuss at least three specific controls from the (CA) family of security controls. Focus on how these controls provide for implementation of assessment, authorization, and monitoring functions to protect the organization's information and information systems. CA-5, for example, calls for developing a specific plan of action and milestones to track security controls implementation. CA-2 requires that all security controls be assessed to determine if they are working as intended.

Your talking points should support (explain) the Office of Risk Management's planned activities in this area for the next fiscal year budget.