RA-3 RA-3 (a) CCI-001048 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the audit trail of assessments to ensure the organization being inspected/assessed conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction. RA-3 RA-3 (b) CCI-001049 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the risk assessment report to ensure the organization being inspected/assessed documents risk assessment results in the risk assessment report. DoD has defined the document as a risk assessment report. RA-3 RA-3 (b) CCI-001642 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they with this CCI because are covered at the they are covered at the DoD DoD level. DoD has defined the document as a risk assessment report. RA-3 RA-3 (c) CCI-001050 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the record of reviews to ensure the organization inspected/assessed reviews risk assessment results upon DoD has defined the frequency as upon
RA-3 RA-3 (a) CCI-001048 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of assessments to ensure the organization being inspected/assessed conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction. RA-3 RA-3 (b) CCI-001049 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the risk assessment report to ensure the organization being inspected/assessed documents risk assessment results in the risk assessment report. DoD has defined the document as a risk assessment report. RA-3 RA-3 (b) CCI-001642 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the document as a risk assessment report. Automatically compliant with this CCI because they are covered at the DoD RA-3 RA-3 (c) CCI-001050 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the record of reviews to ensure the organization inspected/assessed reviews risk assessment results upon DoD has defined the frequency as upon
RMF_Risk-Assessment-Plan.docx