Internal System Connections CA-9

Assessment, Authorization, and Monitoring · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CA-9 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Assessment, Authorization, and Monitoring family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CA-9 (Internal System Connections) is the inside-the-boundary companion to CA-3: instead of links to other systems, it governs the connections between components within this system — the services, agents, and processes that talk to each other. You authorize each internal connection, document what it is and what it carries, shut down the ones you do not need, and review the list on a schedule. It is part of the Low baseline.

What good looks like

Authorize each internal connection — every listening service and the components that talk to it should be there on purpose.
Document the connection: the interface (port and protocol), what data it carries, and its security requirements.
Terminate what you do not need — close ports and stop services that no component actually uses.
Constrain the rest with a host firewall so a service listens only where it should, not on every interface.
Review the list on a defined frequency to catch a service that quietly started listening.

Framework mapping

NIST CSF 2.0 — ID.AM-03 — Authorized network communication and internal and external data flows are maintained
CIS Controls v8 — Control 4 — Implement and manage a firewall on servers

How to move it toward Implemented

Inventory what is listening: ss -tulpn shows every open port and the process behind it — map each one to a component that needs it.
Disable services nothing uses (systemctl disable --now <service>), and bind the rest to a specific interface instead of 0.0.0.0 where you can.
Constrain the survivors with a host firewall — ufw (Uncomplicated Firewall) or nftables rules that allow only the internal connections you documented — and set a review cadence to re-run the inventory.
Attach the listening-services inventory plus the firewall ruleset as hardening evidence on the asset, naming CA-9 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.