PE-6 PE-6 (b) CCI-000940 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant Low Low Low automatically with this CCI compliant with this CCI because they because they are are covered at covered at the DoD the DoD level level. DoD has defined the frequency as every 30 days. PE-6 PE-6 (c) CCI-000941 High High High The organization Moderate Moderate Moderate conducting the Incident Low Low Low inspection/assessment Response Plan obtains and examines documentation of physical security incidents to ensure coordination with the inspected organization's incident response capability occurred. PE-8 (1) PE-8 (1) CCI-000950 High High The organization The system is conducting the not inspection/assessment: considered a 1. obtains HIGH level. documentation Therefore, identifying the this AP is not automated mechanism applicable. in use by the inspected organization to facilitate the maintenance and review of access records 2. Observes the use of the automated mechanism by the inspected organization PE-8 PE-8 (a) CCI-000947 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines visitor access records to determine if the organization is maintaining visitor access records to the facility where the information system resides for at least one year. DoD has defined the time period as at least one year.
PE-6 PE-6 (b) CCI-000940 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 30 days. Automatically compliant with this CCI because they are covered at the DoD level PE-6 PE-6 (c) CCI-000941 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of physical security incidents to ensure coordination with the inspected organization's incident response capability occurred. Incident Response Plan PE-8 (1) PE-8 (1) CCI-000950 High High The organization conducting the inspection/assessment: 1. obtains documentation identifying the automated mechanism in use by the inspected organization to facilitate the maintenance and review of access records 2. Observes the use of the automated mechanism by the inspected organization The system is not considered a HIGH level. Therefore, this AP is not applicable. PE-8 PE-8 (a) CCI-000947 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines visitor access records to determine if the organization is maintaining visitor access records to the facility where the information system resides for at least one year. DoD has defined the time period as at least one year.
RMF_Physical-And-Environmental-Protection-Plan.docx