obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developer of the information system, system component, or information system service determine the exploitation potential for discovered vulnerabilities. SA-15 SA-15 (7) (c) CCI-003278 High The organization conducting The system is not (7) the inspection/assessment considered a obtains and examines the HIGH level. contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developer of the information system, system component, or information system service determine potential risk mitigations for delivered vulnerabilities. SA-15 SA-15 (7) (d) CCI-003279 High The organization conducting The system is not (7) the inspection/assessment considered a obtains and examines the HIGH contracts/agreements to Therefore, this ensure the organization AP is not being inspected/assessed applicable. requires that the developer of the information system, system component, or information system service deliver the outputs of the tools and results of the vulnerability analysis to the ISSO, ISSM, and PM. DoD has defined the personnel or roles as the ISSO, ISSM, and PM. SA-15 SA-15 (7) (d) CCI-003280 High The organization being Automatically (7) inspected/assessed is compliant with automatically compliant with this CCI because this CCI because they are they are covered covered at the DoD level. at the DoD DoD has defined the personnel or roles as the ISSO, ISSM, and PM. SA-15 SA-15 (8) CCI-003281 blank blank The organization conducting NIST has not (8) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service use threat modeling from similar systems,
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service determine the exploitation potential for discovered vulnerabilities. HIGH level. Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (c) CCI-003278 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service determine potential risk mitigations for delivered vulnerabilities. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (d) CCI-003279 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service deliver the outputs of the tools and results of the vulnerability analysis to the ISSO, ISSM, and PM. DoD has defined the personnel or roles as the ISSO, ISSM, and PM. The system is not considered a HIGH Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (d) CCI-003280 High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the ISSO, ISSM, and PM. Automatically compliant with this CCI because they are covered at the DoD SA-15 (8) SA-15 (8) CCI-003281 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service use threat modeling from similar systems, NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx