CM-5 (3) CM-5 (3) High The organization being Automatically inspected/assessed is compliant with this automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products. CM-5 (4) CM-5 (4) blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this AP is documented information not applicable. system components to ensure the organization being inspected/assessed defines the information system components requiring enforcement of a dual authorization for information system changes DoD has determined to the information system components are not appropriate to define at the Enterprise level. CM-5 (4) CM-5 (4) blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this AP is documented system-level not applicable. information to ensure the organization being inspected/assessed defines the system-level information requiring enforcement of a dual authorization for information system changes. DoD has determined to the information is not appropriate to define at the Enterprise level. CM-5 (4) CM-5 (4) blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this AP is documented process to ensure not applicable. the organization inspected/assessed enforces dual authorization for changes to information system components defined in CM-5 (4), CCI 353.
CM-5 (3) CM-5 (3) High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the critical firmware components as any firmware components when the vendor provides digitally signed products. Automatically compliant with this CCI because they are covered at the DoD level CM-5 (4) CM-5 (4) blank blank The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components requiring enforcement of a dual authorization for information system changes DoD has determined to the information system components are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. CM-5 (4) CM-5 (4) blank blank blank The organization conducting the inspection/assessment obtains and examines the documented system-level information to ensure the organization being inspected/assessed defines the system-level information requiring enforcement of a dual authorization for information system changes. DoD has determined to the information is not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. CM-5 (4) CM-5 (4) blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization inspected/assessed enforces dual authorization for changes to information system components defined in CM-5 (4), CCI 353. NIST has not allocated this AP. Therefore, this AP is not applicable.