DoD has determined that the types of inappropriate or unusual activity are not appropriate to define at the Enterprise level. AU-6 (a) High High The organization being Automatically AU-6 Moderate Moderate inspected/assessed is compliant Low Low automatically compliant with this CCI with this CCI because they because they are covered at the DoD are covered at level. the DoD level DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly. AU-6 AU-6 (b) High High The organization Moderate Moderate conducting the Low Low inspection/assessment obtains and examines the documented process for reporting findings as well as a sampling of historical reports to ensure the organization being inspected/assessed reports any findings of inappropriate or unusual activity as defined in AU-6, CCI 1862 to at a minimum, the ISSO and ISSM. DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM. AU-6 AU-6 (b) High High The organization Moderate Moderate conducting the Low Low inspection/assessment obtains and examines the documented list of personnel or roles who should receive the reports of inappropriate or unusual activity defined in AU-6, CCI 1862 to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.
DoD has determined that the types of inappropriate or unusual activity are not appropriate to define at the Enterprise level. AU-6 AU-6 (a) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every seven days or more frequently if required by an alarm event or anomaly. Automatically compliant with this CCI because they are covered at the DoD level AU-6 AU-6 (b) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process for reporting findings as well as a sampling of historical reports to ensure the organization being inspected/assessed reports any findings of inappropriate or unusual activity as defined in AU-6, CCI 1862 to at a minimum, the ISSO and ISSM. DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM. AU-6 AU-6 (b) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should receive the reports of inappropriate or unusual activity defined in AU-6, CCI 1862 to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles.