ensure the organization AP is not inspected/assessed defines applicable. the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. SA-21 SA-21 (1) CCI-003379 blank blank blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. being inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3377 to ensure the required screening criteria are satisfied. NIST has not SA-21 SA-21 (1) CCI-003380 blank blank blank The organization conducting (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this contracts/agreements to AP is not ensure the organization applicable. inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3378 to ensure the required access authorizations are satisfied. SA-21 SA-21 (a) CCI-003383 blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented official AP is not government duties to ensure applicable. the organization being inspected/assessed defines the official government duties to be assigned to the developer of information system, system component, or information system service. DoD has determined the official government duties are not appropriate to define at the Enterprise level. SA-21 SA-21 (a) CCI-003385 blank blank The organization conducting NIST has not the inspection/assessment allocated this AP.
ensure the organization inspected/assessed defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. AP is not applicable. SA-21 (1) SA-21 (1) CCI-003379 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3377 to ensure the required screening criteria are satisfied. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003380 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3378 to ensure the required access authorizations are satisfied. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 (a) CCI-003383 blank blank The organization conducting the inspection/assessment obtains and examines the documented official government duties to ensure the organization being inspected/assessed defines the official government duties to be assigned to the developer of information system, system component, or information system service. DoD has determined the official government duties are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 (a) CCI-003385 blank blank The organization conducting the inspection/assessment NIST has not allocated this AP.
RMF_System-and-Services-Acquisition-Plan.docx