PL-8 PL-8 (b) High High High The organization Automatically Moderate Moderate Moderate inspected/assessed is compliant with Low Low Low automatically compliant with this CCI this CCI because they are because they covered at the DoD level. are covered at the DoD level DoD has defined the frequency as annually. PL-8 PL-8 (c ) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment SSP Low Low Low obtains and examines the security plan to ensure the organization being inspected/assessed includes planned information security architecture changes in the security plan. PL-8 PL-8 (c ) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines security CONOPS to ensure the organization being inspected/assessed includes planned information security architecture changes in the security CONOPS. PL-8 PL-8 (c ) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines a sampling of procurement materials to ensure the organization being inspected/assessed includes planned information security architecture changes in organizational procurements/acquisitions. PL-9 PL-9 blank blank DoDI 8500.01, DoDI 8510.01, Automatically and CNSSI 1253 meet the DoD compliant with requirements for centrally this CCI managing security controls because they and related processes. are covered at the DoD level DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and CNSSI 1253. PL-9 PL-9 blank blank The organization being Automatically inspected/assessed is compliant with automatically compliant with this CCI this CCI because they are because they covered at the DoD level. are covered at the DoD level DoD has defined the security controls and related processes to be centrally managed as CNSSI 1253, DoDI 8510.01, and DoDI 8500.01.
PL-8 PL-8 (b) High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD level PL-8 PL-8 (c ) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed includes planned information security architecture changes in the security plan. SSP PL-8 PL-8 (c ) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines security CONOPS to ensure the organization being inspected/assessed includes planned information security architecture changes in the security CONOPS. eMASS SSP PL-8 PL-8 (c ) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines a sampling of procurement materials to ensure the organization being inspected/assessed includes planned information security architecture changes in organizational procurements/acquisitions. eMASS SSP PL-9 PL-9 blank blank DoDI 8500.01, DoDI 8510.01, and CNSSI 1253 meet the DoD requirements for centrally managing security controls and related processes. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDI 8500.01 and CNSSI 1253. Automatically compliant with this CCI because they are covered at the DoD level PL-9 PL-9 blank blank The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the security controls and related processes to be centrally managed as CNSSI 1253, DoDI 8510.01, and DoDI 8500.01. Automatically compliant with this CCI because they are covered at the DoD level