APPENDIX A DETAILED COMPLIANCE MATRIX – The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations". Control Assessment CCI Confidentiality Integrity Availability Assessment Procedures Reference Number Number SA-1 SA-1 (a) CCI-003089 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with Low Low Low automatically compliant with this CCI because this CCI because they are they are covered covered at the DoD level. at the DoD level DoD has defined the personnel or roles as all personnel. SA-1 SA-1 (a) CCI-003090 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with Low Low Low automatically compliant with this CCI because this CCI because they are they are covered covered at the DoD level. at the DoD level DoD has defined the personnel or roles as all personnel. Automatically SA-1 SA-1 (a) (1) CCI-000602 High High High DoDD 5000.01, DoDI Moderate Moderate Moderate 5000.02, and DoDI 8580.1 compliant with Low Low Low meet the DoD requirements this CCI because for system and services they are covered acquisition policy and at the DoD level procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. SA-1 SA-1 (a) (1) CCI-000603 High High High DoDD 5000.01, DoDI Automatically Moderate Moderate Moderate 5000.02, and DoDI 8580.1 compliant with Low Low Low meet the DoD requirements this CCI because for system and services they are covered acquisition policy and at the DoD procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. SA-1 SA-1 (a) (2) CCI-000605 High High High DoDD 5000.01, DoDI Automatically Moderate Moderate Moderate 5000.02, and DoDI 8580.1 compliant with Low Low Low meet the DoD requirements this CCI because for system and services they are covered acquisition policy and at the DoD level procedures.
APPENDIX A – DETAILED COMPLIANCE MATRIX The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations". Control Number Assessment Number CCI Confidentiality Integrity Availability Assessment Procedures Reference SA-1 SA-1 (a) CCI-003089 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all personnel. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) CCI-003090 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all personnel. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) (1) CCI-000602 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) (1) CCI-000603 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. Automatically compliant with this CCI because they are covered at the DoD SA-1 SA-1 (a) (2) CCI-000605 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. Automatically compliant with this CCI because they are covered at the DoD level
RMF_System-and-Services-Acquisition-Plan.docx