policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. SA-10 SA-10 (1) CCI-000698 High The organization conducting (1) Moderate the inspection/assessment Low obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of software and firmware components. SA-10 SA-10 (2) CCI-000700 blank blank The organization conducting NIST has not (2) the inspection/assessment allocated this AP. obtains and examines the Therefore, this Configuration Control Board AP is not (CCB) charter to determine if applicable. the organization, in the absence of a dedicated software developer configuration management team, has established an alternate configuration management process that is staffed with key organizational personnel. SA-10 SA-10 (3) CCI-003165 blank blank blank The organization conducting NIST has not (3) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of hardware components. SA-10 SA-10 (4) CCI-003166 blank blank blank The organization conducting NIST has not (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of the information system, system component, or information system service employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. SA-10 SA-10 (4) CCI-003167 blank blank blank The organization conducting NIST has not (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed
policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. SA-10 (1) SA-10 (1) CCI-000698 High Moderate Low The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of software and firmware components. SA-10 (2) SA-10 (2) CCI-000700 blank blank The organization conducting the inspection/assessment obtains and examines the Configuration Control Board (CCB) charter to determine if the organization, in the absence of a dedicated software developer configuration management team, has established an alternate configuration management process that is staffed with key organizational personnel. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (3) SA-10 (3) CCI-003165 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of hardware components. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (4) SA-10 (4) CCI-003166 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (4) SA-10 (4) CCI-003167 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx