CA-3 CA-3 (c) High High The organization being Automatically Moderate Moderate inspected/assessed is compliant Low Low automatically compliant with this CCI with this CCI because because they they are covered at the are covered DoD level. at the DoD level DoD has defined the frequency as at least annually. CA-5 (1) CA-5 (1) blank blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. obtains and examines Therefore, documentation of the this AP is not use of the identified applicable. automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. CA-5 (1) CA-5 (1) blank blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. obtains and examines Therefore, documentation of the this AP is not use of the identified applicable. automated mechanisms. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. CA-5 (1) CA-5 (1) blank blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. obtains and examines Therefore, documentation of the this AP is not use of the identified applicable. automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.
CA-3 CA-3 (c) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD level CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_Security-Assessment-and-Authorization-Plan.docx