CM-8 (3) CM-8 (3) High The organization conducting (b) Moderate the inspection/assessment Low obtains and examines the documented process and audit trail for taking action upon detection of unauthorized components to ensure the organization being inspected/assessed takes action to disable network access by unauthorized software, hardware, and firmware components, isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate. CM-8 (4) CM-8 (4) High High The organization conducting The system is not the inspection/assessment considered a HIGH obtains and examines the level. Therefore, this information system AP is not applicable. component inventory to verify that the organization being inspected/assessed identifies within their inventory, the name and position or role of individuals responsible/accountable for administering those components or a means of identifying those individuals. CM-8 (5) CM-8 (5) High The organization conducting System Security Plan Moderate the inspection/assessment (external link) obtains and examines the inventory list of the authorized information system and verifies that all components identified during the inspection are not duplicated in other information system inventories.
CM-8 (3) CM-8 (3) (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process and audit trail for taking action upon detection of unauthorized components to ensure the organization being inspected/assessed takes action to disable network access by unauthorized software, hardware, and firmware components, isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate. CM-8 (4) CM-8 (4) High High The organization conducting the inspection/assessment obtains and examines the information system component inventory to verify that the organization being inspected/assessed identifies within their inventory, the name and position or role of individuals responsible/accountable for administering those components or a means of identifying those individuals. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-8 (5) CM-8 (5) High Moderate The organization conducting the inspection/assessment obtains and examines the inventory list of the authorized information system and verifies that all components identified during the inspection are not duplicated in other information system inventories. System Security Plan (external link)
RMF_Configuration-Management-Plan.docx