CM-8 (3) CM-8 (3) High The organization conducting System Security Plan (a) Moderate the inspection/assessment (external link) Low obtains and examines the documentation identifying the automated mechanisms and examines the implemented automated mechanisms to ensure the organization inspected/assessed employs automated mechanisms, continuously, to detect the presence of unauthorized hardware, software, and firmware components within the information system. DoD has defined the frequency as continuously. CM-8 (3) CM-8 (3) High The organization being Automatically (a) Moderate inspected/assessed is compliant with this Low automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the frequency as continuously. CM-8 (3) CM-8 (3) High The organization conducting (b) Moderate the inspection/assessment Low obtains and examines the documented list of personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.
CM-8 (3) CM-8 (3) (a) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanisms and examines the implemented automated mechanisms to ensure the organization inspected/assessed employs automated mechanisms, continuously, to detect the presence of unauthorized hardware, software, and firmware components within the information system. DoD has defined the frequency as continuously. System Security Plan (external link) CM-8 (3) CM-8 (3) (a) High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as continuously. Automatically compliant with this CCI because they are covered at the DoD level CM-8 (3) CM-8 (3) (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.
RMF_Configuration-Management-Plan.docx