CM-6 CM-6 (c) High The organization conducting Moderate the inspection/assessment System Security Plan Low obtains and examines the (external link) security plan to ensure the organization inspected/assessed has documented deviations from configuration settings for information system components. CM-6 CM-6 (c) High The organization conducting Moderate the inspection/assessment System Security Plan Low obtains and examines the (external link) security plan and the audit trail of approved changes to ensure the deviations are approved IAW CM-3, CCI 314. CM-6 CM-6 (d) High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented process to ensure the organization being inspected/assessed monitors changes to the configuration settings in accordance with organizational policies and procedures. CM-6 CM-6 (d) High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented process to ensure the organization being inspected/assessed controls changes to the configuration settings in accordance with organizational policies and procedures. CM-7 (1) CM-7 (1) High High The organization conducting (a) Moderate Moderate the inspection/assessment Scan results (external Low Low obtains and examines the link) documented process and audit trail of reviews to ensure the organization being inspected/assessed reviews the information system every 30 days to identify unnecessary and non-secure functions, ports, protocols, and services. DoD has defined the frequency as every 30 days. CM-7 (1) CM-7 (1) High High The organization Automatically (a) Moderate Moderate inspected/assessed is compliant with this Low Low automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the frequency as every 30 days.
CM-6 CM-6 (c) High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization inspected/assessed has documented deviations from configuration settings for information system components. System Security Plan (external link) CM-6 CM-6 (c) High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan and the audit trail of approved changes to ensure the deviations are approved IAW CM-3, CCI 314. System Security Plan (external link) CM-6 CM-6 (d) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed monitors changes to the configuration settings in accordance with organizational policies and procedures. CM-6 CM-6 (d) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls changes to the configuration settings in accordance with organizational policies and procedures. CM-7 (1) CM-7 (1) (a) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process and audit trail of reviews to ensure the organization being inspected/assessed reviews the information system every 30 days to identify unnecessary and non-secure functions, ports, protocols, and services. DoD has defined the frequency as every 30 days. Scan results (external link) CM-7 (1) CM-7 (1) (a) High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 30 days. Automatically compliant with this CCI because they are covered at the DoD level