defines the frequency to scan for counterfeit information system components. DoD has determined the frequency is not appropriate to define at the Enterprise level. SA-19 SA-19 (4) CCI-003389 blank blank The organization conducting NIST has not (4) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process as well AP is not as the record of scans to applicable. ensure the organization being inspected/assessed scans for counterfeit information system components in accordance with the frequency defined in SA-19 (4), CCI 3388. SA-19 SA-19 (a) CCI-003356 High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented anti-counterfeit policy to ensure the organization inspected/assessed develops an anti-counterfeit policy that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003357 High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented anti-counterfeit policy to ensure the organization being inspected/assessed develops an anti-counterfeit policy that include the means to prevent counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003358 High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented anti-counterfeit procedures to ensure the organization being inspected/assessed develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003359 High The organization conducting Moderate the inspection/assessment Low obtains and examines the documented anti-counterfeit procedures to ensure the organization being
defines the frequency to scan for counterfeit information system components. DoD has determined the frequency is not appropriate to define at the Enterprise level. SA-19 (4) SA-19 (4) CCI-003389 blank blank The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of scans to ensure the organization being inspected/assessed scans for counterfeit information system components in accordance with the frequency defined in SA-19 (4), CCI 3388. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 SA-19 (a) CCI-003356 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit policy to ensure the organization inspected/assessed develops an anti-counterfeit policy that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003357 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit policy to ensure the organization being inspected/assessed develops an anti-counterfeit policy that include the means to prevent counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003358 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit procedures to ensure the organization being inspected/assessed develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003359 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit procedures to ensure the organization being
RMF_System-and-Services-Acquisition-Plan.docx