CM-2 (7) CM-2 (7) b High The organization conducting Moderate the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security safeguards to be applied to devices when they return from areas of significant risk. DoD has determined that this value is not appropriate to define at the Enterprise level. CM-3 (1) CM-3 (1) High The organization conducting The system is not (a) the inspection/assessment considered a HIGH obtains and examines level. Therefore, this documentation of the use of AP is not applicable. the identified automated mechanisms to ensure that the identified system documents proposed changes. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. CM-3 (1) High The organization conducting The system is not CM-3 (1) (b) the inspection/assessment considered a HIGH obtains and examines level. Therefore, this documentation of the use of AP is not applicable. the identified automated mechanisms to ensure that the identified system notifies designated approval authorities of proposed changes to the information system and request change approval. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. CM-3 (1) CM-3 (1) High The organization being Automatically (b) inspected/assessed is compliant with this automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. level DoD has defined the approval authorities as the configuration control board (CCB).
CM-2 (7) CM-2 (7) b High Moderate The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security safeguards to be applied to devices when they return from areas of significant risk. DoD has determined that this value is not appropriate to define at the Enterprise level. CM-3 (1) CM-3 (1) (a) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system documents proposed changes. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-3 (1) CM-3 (1) (b) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system notifies designated approval authorities of proposed changes to the information system and request change approval. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-3 (1) CM-3 (1) (b) High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the approval authorities as the configuration control board (CCB). Automatically compliant with this CCI because they are covered at the DoD level
RMF_Configuration-Management-Plan.docx