this CCI because they are they are covered covered at the DoD level. at the DoD level DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA. SA-8 SA-8 CCI-000664 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the system requirements documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the specification of the information system. SA-8 SA-8 CCI-000665 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the design documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the design of the information system. SA-8 SA-8 CCI-000666 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the system development procedures (e.g. configuration management plans, code review procedures, and coding style guides) to ensure that the organization being inspected/assessed applies information system security engineering principles in the development of the information system. SA-8 SA-8 CCI-000667 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the audit trail artifacts that were created during the implementation of SA-8, CCI 000666 to ensure that the organization being inspected/assessed applies information system security engineering principles in the implementation of the information system and that changes are made IAW the configuration management plan (CM-9, CCI 001790). SA-8 SA-8 CCI-000668 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the
this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA. they are covered at the DoD level SA-8 SA-8 CCI-000664 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the system requirements documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the specification of the information system. SA-8 SA-8 CCI-000665 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the design documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the design of the information system. SA-8 SA-8 CCI-000666 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the system development procedures (e.g. configuration management plans, code review procedures, and coding style guides) to ensure that the organization being inspected/assessed applies information system security engineering principles in the development of the information system. SA-8 SA-8 CCI-000667 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail artifacts that were created during the implementation of SA-8, CCI 000666 to ensure that the organization being inspected/assessed applies information system security engineering principles in the implementation of the information system and that changes are made IAW the configuration management plan (CM-9, CCI 001790). SA-8 SA-8 CCI-000668 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the
RMF_System-and-Services-Acquisition-Plan.docx