defines the level of detail the implementation information of the security controls is required to be provided by the developer of the information system, system component, or information system services. DoD has determined the level of detail is not appropriate to define at the Enterprise level. SA-4 (3) SA-4 (3) CCI-003107 High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes defined in SA-4 (3), CCI 3108. The system is not SA-4 (3) SA-4 (3) CCI-003108 High The organization conducting the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. defines the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service needs to include when demonstrating the use of a system development life cycle. SA-4 (5) SA-4 (5) (a) CCI-003109 High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not inspected/assessed requires applicable. he developer of the information system, system component, or information
defines the level of detail the implementation information of the security controls is required to be provided by the developer of the information system, system component, or information system services. DoD has determined the level of detail is not appropriate to define at the Enterprise level. SA-4 (3) SA-4 (3) CCI-003107 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes defined in SA-4 (3), CCI 3108. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-4 (3) SA-4 (3) CCI-003108 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed defines the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service needs to include when demonstrating the use of a system development life cycle. The system is not considered a HIGH Therefore, this AP is not applicable. SA-4 (5) SA-4 (5) (a) CCI-003109 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires he developer of the information system, system component, or information The system is not considered a HIGH Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx