obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to software. SA-17 SA-17 (4) (d) CCI-003330 blank blank blank The organization conducting NIST has not (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware. NIST has not SA-17 SA-17 (4) (e) CCI-003331 blank blank The organization conducting (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service describe the hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the hardware. SA-17 SA-17 (4) (e) CCI-003332 blank blank The organization conducting NIST has not (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service describe the software mechanisms not addressed in the descriptive top-level specification but strictly internal to the software.
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to software. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (d) CCI-003330 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (e) CCI-003331 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the hardware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (e) CCI-003332 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the software mechanisms not addressed in the descriptive top-level specification but strictly internal to the software. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx