obtains and examines the Therefore, this documented indications to AP is not ensure the organization applicable. inspected/assessed defines indications of need for inspection to detect tampering during inspections of information systems, system components, or devices. DoD has determined the indications are not appropriate to define at the Enterprise level. SA-19 SA-19 (1) CCI-003367 blank blank blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process, the list AP is not of personnel responsible for applicable. detecting counterfeit information system components, as well as the record of training to ensure the organization being inspected/assessed trains personnel or roles defined in SA-19 (1), CCI 3368 to detect counterfeit information system components (including hardware, software, and firmware). SA-19 SA-19 (1) CCI-003368 blank blank blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented personnel or AP is not roles to ensure the applicable. organization being inspected/assessed defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware). DoD has determined the personnel or roles are not appropriate to define at the Enterprise level. SA-19 SA-19 (2) CCI-003369 blank blank The organization conducting NIST has not (2) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process to AP is not ensure the organization applicable. being inspected/assessed maintains configuration control l over information system components defined in SA-19 (2), CCI 3370 awaiting service/repair.
obtains and examines the documented indications to ensure the organization inspected/assessed defines indications of need for inspection to detect tampering during inspections of information systems, system components, or devices. DoD has determined the indications are not appropriate to define at the Enterprise level. Therefore, this AP is not applicable. SA-19 (1) SA-19 (1) CCI-003367 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented process, the list of personnel responsible for detecting counterfeit information system components, as well as the record of training to ensure the organization being inspected/assessed trains personnel or roles defined in SA-19 (1), CCI 3368 to detect counterfeit information system components (including hardware, software, and firmware). NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (1) SA-19 (1) CCI-003368 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware). DoD has determined the personnel or roles are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (2) SA-19 (2) CCI-003369 blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains configuration control l over information system components defined in SA-19 (2), CCI 3370 awaiting service/repair. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx