RA-1 RA-1 (b) (2) CCI-001044 High High High DoD Components are Automatically Moderate Moderate Moderate automatically compliant compliant with this Low Low Low with this CCI because CCI because they they are covered by the are covered at the DoDi 8510.01 which DoD level adopts NIST SP 800-30 as the DoD risk assessment policy. DoD has defined the frequency as annually - updated as appropriate. RA-2 RA-2 (a) CCI-001045 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed categorizes information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. RA-2 RA-2 (b) CCI-001046 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the documented security categorization results to ensure the organization being inspected/assessed documents the security categorization results (including supporting rationale) in the security plan for the information system IAW CNSSI 1253. RA-2 RA-2 (c) CCI-001047 High High High The organization Moderate Moderate Moderate conducting the Low Low Low inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.
RA-1 RA-1 (b) (2) CCI-001044 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy. DoD has defined the frequency as annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level RA-2 RA-2 (a) CCI-001045 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed categorizes information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. RA-2 RA-2 (b) CCI-001046 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security categorization results to ensure the organization being inspected/assessed documents the security categorization results (including supporting rationale) in the security plan for the information system IAW CNSSI 1253. RA-2 RA-2 (c) CCI-001047 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.
RMF_Risk-Assessment-Plan.docx