CM-5 (2) CM-5 (2) High The organization conducting Moderate the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the information system changes when there is an incident or when planned changes have been performed to determine whether unauthorized changes have occurred. DoD has defined the circumstances as when there is an incident or when planned changes have been performed. CM-5 (2) CM-5 (2) High The organization being Automatically Moderate inspected/assessed is compliant with this automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems. CM-5 (2) CM-5 (2) High The organization Automatically Moderate inspected/assessed is compliant with this automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the circumstances as when there is an incident or when planned changes have been performed.
CM-5 (2) CM-5 (2) High Moderate The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the information system changes when there is an incident or when planned changes have been performed to determine whether unauthorized changes have occurred. DoD has defined the circumstances as when there is an incident or when planned changes have been performed. CM-5 (2) CM-5 (2) High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems. Automatically compliant with this CCI because they are covered at the DoD level CM-5 (2) CM-5 (2) High Moderate The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the circumstances as when there is an incident or when planned changes have been performed. Automatically compliant with this CCI because they are covered at the DoD level
RMF_Configuration-Management-Plan.docx