CA-2 (2) CA-2 (2) High High High The organization being Automatically inspected/assessed is compliant automatically compliant with this CCI with this CCI because because they they are covered at the are covered DoD level. at the DoD level DoD has defined the frequency as at least annually. CA-2 (3) CA-2 (3) blank blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. obtains and examines Therefore, the documented this AP is not information systems to applicable. ensure the organization being inspected/assessed defines the information systems for which they will accept the results of an assessment performed by an external organization. DoD has determined the information systems are not appropriate to define at the Enterprise level.
CA-2 (2) CA-2 (2) High High High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD level CA-2 (3) CA-2 (3) blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure the organization being inspected/assessed defines the information systems for which they will accept the results of an assessment performed by an external organization. DoD has determined the information systems are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_Security-Assessment-and-Authorization-Plan.docx