PL-8 PL-8 (a) (1) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information. PL-8 PL-8 (a) (2) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, how the information security architecture is integrated into and supports the enterprise architecture. PL-8 PL-8 (a) (3) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, any information security assumptions about, and dependencies on, external services. PL-8 PL-8 (b) High High High The organization conducting Moderate Moderate Moderate the inspection/assessment eMASS SSP Low Low Low obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture. DoD has defined the frequency as annually.
PL-8 PL-8 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information. eMASS SSP PL-8 PL-8 (a) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, how the information security architecture is integrated into and supports the enterprise architecture. eMASS SSP PL-8 PL-8 (a) (3) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, any information security assumptions about, and dependencies on, external services. eMASS SSP PL-8 PL-8 (b) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture. DoD has defined the frequency as annually. eMASS SSP
RMF_Security-Planning.docx