lessons learned from past incidents). IR-8 IR-8 (c) CCI-000847 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they are with this CCI because they covered at the DoD are covered at the DoD level level. DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents). IR-8 IR-8 (d) CCI-000849 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines documentation of the update actions for the incident response plan to ensure the organization is updating the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporating lessons learned from past incidents (IR-4a). IR-8 IR-8 (e ) CCI-002803 High High High The organization being Automatically Moderate Moderate Moderate inspected/assessed is compliant with this Low Low Low automatically compliant CCI because they are with this CCI because they covered at the DoD are covered at the DoD level level. DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made.
lessons learned from past incidents). IR-8 IR-8 (c) CCI-000847 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually (incorporating lessons learned from past incidents). Automatically compliant with this CCI because they are covered at the DoD level IR-8 IR-8 (d) CCI-000849 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of the update actions for the incident response plan to ensure the organization is updating the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing and incorporating lessons learned from past incidents (IR-4a). IR-8 IR-8 (e ) CCI-002803 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the incident response personnel as all stakeholders identified in the incident response plan, not later than 30 days after the change is made. Automatically compliant with this CCI because they are covered at the DoD level
RMF_Incident-Response-Plan.docx