obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 have appropriate access authorizations as determined by assigned official government duties defined in SA-21, CCI 3383. SA-21 SA-21 (b) CCI-003382 blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 satisfy additional personnel screening criteria defined in SA-21, CCI 3381. NIST has not SA-21 SA-21 (b) CCI-003381 blank blank The organization conducting the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented additional AP is not personnel screening criteria applicable. to ensure the organization being inspected/assessed defines additional personnel screening criteria that must be satisfied by the developer of organization-defined information system, system component, or information system service. DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level. SA-22 SA-22 (1) CCI-003372 blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented support to AP is not ensure the organization applicable. being inspected/assessed defines the support from external providers to be provided for unsupported information system components. DoD has determined the support from external providers is not appropriate
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 have appropriate access authorizations as determined by assigned official government duties defined in SA-21, CCI 3383. Therefore, this AP is not applicable. SA-21 SA-21 (b) CCI-003382 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service defined in SA-21, CCI 3384 satisfy additional personnel screening criteria defined in SA-21, CCI 3381. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 (b) CCI-003381 blank blank The organization conducting the inspection/assessment obtains and examines the documented additional personnel screening criteria to ensure the organization being inspected/assessed defines additional personnel screening criteria that must be satisfied by the developer of organization-defined information system, system component, or information system service. DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-22 (1) SA-22 (1) CCI-003372 blank The organization conducting the inspection/assessment obtains and examines the documented support to ensure the organization being inspected/assessed defines the support from external providers to be provided for unsupported information system components. DoD has determined the support from external providers is not appropriate NIST has not allocated this AP. Therefore, this AP is not applicable.