DoD has determined the critical information system components are not appropriate to define at the Enterprise level. SA-20 SA-20 CCI-003387 blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines Therefore, this hardware and software lists AP is not to ensure that no applicable. commercial off-the-shelf components are used as critical information system components defined in CCI 3386. SA-21 SA-21 CCI-003384 blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented information AP is not system, system component, applicable. or information system service to ensure the organization being inspected/assessed defines the information system, system component, or information system service which require the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria. DoD has determined the information system, system component, or information system service is not appropriate to define at the Enterprise level. NIST has not SA-21 SA-21 (1) CCI-003377 blank blank blank The organization conducting (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented actions to AP is not ensure the organization applicable. inspected/assessed defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. SA-21 SA-21 (1) CCI-003378 blank blank The organization conducting NIST has not (1) the inspection/assessment allocated this AP. obtains and examines the Therefore, this documented actions to
DoD has determined the critical information system components are not appropriate to define at the Enterprise level. SA-20 SA-20 CCI-003387 blank blank blank The organization conducting the inspection/assessment obtains and examines hardware and software lists to ensure that no commercial off-the-shelf components are used as critical information system components defined in CCI 3386. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 CCI-003384 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information system, system component, or information system service to ensure the organization being inspected/assessed defines the information system, system component, or information system service which require the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria. DoD has determined the information system, system component, or information system service is not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003377 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization inspected/assessed defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003378 blank blank The organization conducting the inspection/assessment obtains and examines the documented actions to NIST has not allocated this AP. Therefore, this
RMF_System-and-Services-Acquisition-Plan.docx