policies are not appropriate to define at the Enterprise level. CM-11 CM-11 (b) High High The organization conducting Moderate Moderate the inspection/assessment Low Low obtains and examines software installation policies defined in CM-11, CCI 1804 and inspects the methods defined in CM-11, CCI 1806 to verify they are properly implemented. CM-11 CM-11 (c ) High High The organization conducting Moderate Moderate the inspection/assessment Low Low obtains and examines the audit trails of monitoring activities to ensure the organization being inspected/assessed monitors software installation policy compliance at least monthly. DoD has defined the frequency as at least monthly. CM-11 CM-11 (c ) High High The organization being Automatically Moderate Moderate inspected/assessed is compliant with this Low Low automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the frequency as at least monthly. CM-2 CM-2 High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented baseline configuration. CM-2 CM-2 High The organization conducting Moderate the inspection/assessment Low obtains and examines the current baseline to ensure the current configuration matches the current documented baseline. CM-2 (1) CM-2 (1) High The organization conducting (a) Moderate the inspection/assessment Low obtains and examines documentation of organizational reviews and update actions for the baseline configuration to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually. CM-2 (1) CM-2 (1) High The organization Automatically (a) Moderate inspected/assessed is compliant with this Low automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level.
policies are not appropriate to define at the Enterprise level. CM-11 CM-11 (b) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines software installation policies defined in CM-11, CCI 1804 and inspects the methods defined in CM-11, CCI 1806 to verify they are properly implemented. CM-11 CM-11 (c ) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trails of monitoring activities to ensure the organization being inspected/assessed monitors software installation policy compliance at least monthly. DoD has defined the frequency as at least monthly. CM-11 CM-11 (c ) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least monthly. Automatically compliant with this CCI because they are covered at the DoD level CM-2 CM-2 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented baseline configuration. CM-2 CM-2 High Moderate Low The organization conducting the inspection/assessment obtains and examines the current baseline to ensure the current configuration matches the current documented baseline. CM-2 (1) CM-2 (1) (a) High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually. CM-2 (1) CM-2 (1) (a) High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. Automatically compliant with this CCI because they are covered at the DoD
RMF_Configuration-Management-Plan.docx