IR-1 IR-1 (b) (2) CCI-000812 High High High The organization Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they are with this CCI because they covered at the DoD are covered at the DoD level level. DoD has defined the frequency as reviewed annually - updated as appropriate. IR-1 IR-1 (b) (2) CCI-000811 High High High CJCSI 6510.01F Automatically Moderate Moderate Moderate "Information Assurance and compliant with this Low Low Low Support to Computer CCI because they are Network Defense," CJCSM covered at the DoD 6510.01B, "Cyber Incident level Handling Program," DoDD O-8530.1, and DoDI meet the DoD requirements for incident response policy and procedures. DoD Components are automatically compliant with this CCI because they are covered at the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD and DoDI O-8530.2. DoD has defined the frequency as reviewed annually - updated as appropriate. IR-10 IR-10 CCI-002822 High High High The organization Moderate Moderate Moderate conducting the inspection/assessment Note: Code Analysis, obtains and examines tool development appointments to the and real-time integrated team as well as operations are Tier-2 the documented roles and responsibilities and responsibilities to ensure outside the scope of the organization being this Organization inspected/assessed establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel. IR-2 (1) IR-2 (1) CCI-000816 High High High The organization The system is not conducting the considered a HIGH inspection/assessment level. Therefore, this obtains and examines AP is not applicable. incident response training materials and a record of training events to ensure that simulated events have been included.
IR-1 IR-1 (b) (2) CCI-000812 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level IR-1 IR-1 (b) (2) CCI-000811 High Moderate Low High Moderate Low High Moderate Low CJCSI 6510.01F "Information Assurance and Support to Computer Network Defense," CJCSM 6510.01B, "Cyber Incident Handling Program," DoDD O-8530.1, and DoDI meet the DoD requirements for incident response policy and procedures. DoD Components are automatically compliant with this CCI because they are covered at the DoD level with the following policies: CJCSI 6510.01F, CJCSM 6510.01B, DoDD and DoDI O-8530.2. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level IR-10 IR-10 CCI-002822 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines appointments to the integrated team as well as the documented roles and responsibilities to ensure the organization being inspected/assessed establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel. Note: Code Analysis, tool development and real-time operations are Tier-2 responsibilities and outside the scope of this Organization IR-2 (1) IR-2 (1) CCI-000816 High High High The organization conducting the inspection/assessment obtains and examines incident response training materials and a record of training events to ensure that simulated events have been included. The system is not considered a HIGH level. Therefore, this AP is not applicable.
RMF_Incident-Response-Plan.docx