IR-9 (4) IR-9 (4) CCI-002821 High The organization Moderate conducting the Low inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to employ for personnel exposed to information not within assigned access authorizations. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. IR-9 IR-9 (a) CCI-002805 High The organization Moderate conducting the Low inspection/assessment obtains and examines the incident response plan as well as action reports of incidents to ensure that specific information involved in the information system contamination is identified. IR-9 IR-9 (b) CCI-002806 High The organization Moderate conducting the Low inspection/assessment obtains and examines the incident response plan as well as action reports of incidents to ensure that at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center were alerted of the information spill using a method of communication not associated with the spill. DoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center.
IR-9 (4) IR-9 (4) CCI-002821 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to employ for personnel exposed to information not within assigned access authorizations. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. IR-9 IR-9 (a) CCI-002805 High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan as well as action reports of incidents to ensure that specific information involved in the information system contamination is identified. IR-9 IR-9 (b) CCI-002806 High Moderate Low The organization conducting the inspection/assessment obtains and examines the incident response plan as well as action reports of incidents to ensure that at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center were alerted of the information spill using a method of communication not associated with the spill. DoD has defined the personnel or roles as at a minimum, the OCA, the information owner/originator, the ISSM, the activity security manager, and the responsible computer incident response center.