SA-2 SA-2 (b) CCI-000611 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has documented the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (b) CCI-000612 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has allocated the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (c) CCI-000613 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-2 SA-2 (c) CCI-000614 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-20 SA-20 CCI-003386 blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented critical AP is not information system applicable. components to ensure the organization being inspected/assessed defines the critical information system components to or custom develop.
SA-2 SA-2 (b) CCI-000611 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has documented the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (b) CCI-000612 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has allocated the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (c) CCI-000613 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-2 SA-2 (c) CCI-000614 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-20 SA-20 CCI-003386 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented critical information system components to ensure the organization being inspected/assessed defines the critical information system components to or custom develop. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx