to define at the Enterprise level. SA-22 SA-22 (1) CCI-003373 blank blank blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented process to AP is not ensure the organization applicable. inspected/assessed provides in-house support and/or support from external providers defined in SA-22 (1), CCI 3372 for unsupported information system components. SA-22 SA-22 (a) CCI-003376 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH level. documented process as well Therefore, this as the hardware and AP is not software lists to ensure the applicable. organization being inspected/assessed replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer. SA-22 SA-22 (b) CCI-003374 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH level. hardware and software lists Therefore, this as well as the documented AP is not approvals to ensure the applicable. organization being inspected/assessed documents approval for the continued use of unsupported system components required to satisfy mission/business needs. SA-22 SA-22 (b) CCI-003375 High High High The organization conducting The system is not the inspection/assessment considered a obtains and examines the HIGH documented justification as Therefore, this well as the hardware and AP is not software lists to ensure the applicable. organization being inspected/assessed provides justification for the continued use of unsupported system components required to satisfy mission/business needs. SA-3 SA-3 (a) CCI-003092 High High High The organization conducting Moderate Moderate Moderate the inspection/assessment Low Low Low obtains and examines the documented system development life to ensure the organization being inspected/assessed
to define at the Enterprise level. SA-22 (1) SA-22 (1) CCI-003373 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization inspected/assessed provides in-house support and/or support from external providers defined in SA-22 (1), CCI 3372 for unsupported information system components. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-22 SA-22 (a) CCI-003376 High High High The organization conducting the inspection/assessment obtains and examines the documented process as well as the hardware and software lists to ensure the organization being inspected/assessed replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-22 SA-22 (b) CCI-003374 High High High The organization conducting the inspection/assessment obtains and examines the hardware and software lists as well as the documented approvals to ensure the organization being inspected/assessed documents approval for the continued use of unsupported system components required to satisfy mission/business needs. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-22 SA-22 (b) CCI-003375 High High High The organization conducting the inspection/assessment obtains and examines the documented justification as well as the hardware and software lists to ensure the organization being inspected/assessed provides justification for the continued use of unsupported system components required to satisfy mission/business needs. The system is not considered a HIGH Therefore, this AP is not applicable. SA-3 SA-3 (a) CCI-003092 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented system development life to ensure the organization being inspected/assessed
RMF_System-and-Services-Acquisition-Plan.docx