component received is genuine and has not been altered. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. SA-12 SA-12 (10) CCI-003213 blank blank blank The organization conducting NIST has not (10) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented security AP is not safeguards to ensure they applicable. have been defined IAW DoDI 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. SA-12 SA-12 (11) CCI-003214 High High High The organization conducting The system is not (11) the inspection/assessment considered a obtains and examines the HIGH documented processes to Therefore, this ensure the organization AP is not inspected/assessed employs applicable. organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of supply chain elements, processes and actors defined in SA-12 (11), CCI 3215 associated with the information system, system component, or information system service. The system is not SA-12 SA-12 (11) CCI-003215 High High High The organization conducting (11) the inspection/assessment considered a obtains and examines the HIGH level. documented supply chain Therefore, this elements, processes, and AP is not actors to ensure the applicable. organization being inspected/assessed defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing IAW DoDI 5200.44. DoD has determined the elements, processes, and actions are not appropriate
component received is genuine and has not been altered. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. SA-12 (10) SA-12 (10) CCI-003213 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined IAW DoDI 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (11) SA-12 (11) CCI-003214 High High High The organization conducting the inspection/assessment obtains and examines the documented processes to ensure the organization inspected/assessed employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of supply chain elements, processes and actors defined in SA-12 (11), CCI 3215 associated with the information system, system component, or information system service. The system is not considered a HIGH Therefore, this AP is not applicable. SA-12 (11) SA-12 (11) CCI-003215 High High High The organization conducting the inspection/assessment obtains and examines the documented supply chain elements, processes, and actors to ensure the organization being inspected/assessed defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing IAW DoDI 5200.44. DoD has determined the elements, processes, and actions are not appropriate The system is not considered a HIGH level. Therefore, this AP is not applicable.
RMF_System-and-Services-Acquisition-Plan.docx