system service structure security-relevant firmware to facilitate controlling access with least privilege. SA-17 SA-17 (a) CCI-003294 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not inspected/assessed requires applicable. that the developer produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is interrogated part of the organization's enterprise architecture. SA-17 SA-17 (b) CCI-003295 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not inspected/assessed requires applicable. that the developer produce a design specification and security architecture that accurately and completely describes the required security functionality. SA-17 SA-17 (b) CCI-003296 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developer produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components. SA-17 SA-17 (c) CCI-003297 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developer produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection.
system service structure security-relevant firmware to facilitate controlling access with least privilege. SA-17 SA-17 (a) CCI-003294 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is interrogated part of the organization's enterprise architecture. The system is not considered a HIGH Therefore, this AP is not applicable. SA-17 SA-17 (b) CCI-003295 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the required security functionality. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-17 SA-17 (b) CCI-003296 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components. The system is not considered a HIGH Therefore, this AP is not applicable. SA-17 SA-17 (c) CCI-003297 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. The system is not considered a HIGH level. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx