RA-3 RA-3 (c) CCI-001051 High High High The organization Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they with this CCI because are covered at the they are covered at the DoD level DoD level. DoD has defined the frequency as upon RA-3 RA-3 (d) CCI-002370 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disseminates the risk assessment results to the ISSM, ISSO, AO, and PM. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. RA-3 RA-3 (d) CCI-002371 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they with this CCI because are covered at the they are covered at the DoD level DoD level. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. RA-3 RA-3 (e ) CCI-001052 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines historical versions of the risk assessment as well as records of changes to the system to ensure the organization being inspected/assessed updates the risk assessment upon or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system. DoD has defined the frequency as upon
RA-3 RA-3 (c) CCI-001051 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as upon Automatically compliant with this CCI because they are covered at the DoD level RA-3 RA-3 (d) CCI-002370 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disseminates the risk assessment results to the ISSM, ISSO, AO, and PM. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. RA-3 RA-3 (d) CCI-002371 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. Automatically compliant with this CCI because they are covered at the DoD level RA-3 RA-3 (e ) CCI-001052 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines historical versions of the risk assessment as well as records of changes to the system to ensure the organization being inspected/assessed updates the risk assessment upon or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system. DoD has defined the frequency as upon
RMF_Risk-Assessment-Plan.docx