inspection/assessment AP. Therefore, examines the information this AP is not system to ensure the applicable. producer identity is bound to the information with the strength of binding defined in AU-10 (1) CCI 1900. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1901. AU-10 AU-10 (1) blank The organization NIST has not (1) (b) conducting the allocated this inspection/assessment AP. Therefore, examines the information this AP is not system to ensure applicable. authorized individuals are able to determine the identity of the producer of the information. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1902. AU-10 AU-10 (2) blank blank blank The organization being Automatically (2) (a) inspected/assessed is compliant automatically compliant with this CCI with this CCI because they because they are covered at the DoD are covered at level. the DoD DoD has defined the
inspection/assessment examines the information system to ensure the producer identity is bound to the information with the strength of binding defined in AU-10 (1) CCI 1900. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1901. AP. Therefore, this AP is not applicable. AU-10 (1) AU-10 (1) (b) blank The organization conducting the inspection/assessment examines the information system to ensure authorized individuals are able to determine the identity of the producer of the information. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1902. NIST has not allocated this AP. Therefore, this AP is not applicable. AU-10 (2) AU-10 (2) (a) blank blank blank The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the Automatically compliant with this CCI because they are covered at the DoD
RMF_Audit-and-Accountability-Plan.docx