inspected/assessed retains unique identification of supply chain elements, processes, and actors. SA-12 SA-12 (15) CCI-003224 blank blank The organization conducting NIST has not (15) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process to AP is not ensure the organization applicable. being inspected/assessed establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements. SA-12 SA-12 (2) CCI-003200 blank blank The organization conducting NIST has not (2) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process as well AP is not as the record of supplier applicable. review to ensure the organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service. SA-12 SA-12 (5) CCI-003201 High High High The organization conducting The system is not (5) the inspection/assessment considered a obtains and examines the HIGH record of security safeguards Therefore, this supplied to ensure the AP is not organization applicable. inspected/assessed employs security safeguards defined in SA-12 (5), CCI 3202 to limit harm from potential adversaries identifying and targeting the organizational supply chain. SA-12 SA-12 (5) CCI-003202 High High High The conducting the The system is not (5) inspection/assessment considered a obtains and examines the HIGH level. documented security Therefore, this safeguards to ensure they AP is not have been defined IAW DoDI applicable. 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise SA-12 SA-12 (7) CCI-003203 blank blank blank The organization conducting NIST has not (7) the inspection/assessment allocated this AP. obtains and examines Therefore, this documented assessment(s) AP is not that were conducted by the applicable.
inspected/assessed retains unique identification of supply chain elements, processes, and actors. SA-12 (15) SA-12 (15) CCI-003224 blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (2) SA-12 (2) CCI-003200 blank blank The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of supplier review to ensure the organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (5) SA-12 (5) CCI-003201 High High High The organization conducting the inspection/assessment obtains and examines the record of security safeguards supplied to ensure the organization inspected/assessed employs security safeguards defined in SA-12 (5), CCI 3202 to limit harm from potential adversaries identifying and targeting the organizational supply chain. The system is not considered a HIGH Therefore, this AP is not applicable. SA-12 (5) SA-12 (5) CCI-003202 High High High The conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined IAW DoDI 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-12 (7) SA-12 (7) CCI-003203 blank blank blank The organization conducting the inspection/assessment obtains and examines documented assessment(s) that were conducted by the NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx