The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations". Control Number Assessment Number CCI Confidentiality Integrity Availability Assessment Procedures Reference CP-1 CP-1 (a) (1) CCI-002825 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all stakeholders identified in the contingency plan. Automatically compliant with this CCI because they are covered at the DoD CP-1 CP-1 (a) (1) CCI-000438 High Moderate Low High Moderate Low High Moderate Low DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP Automatically compliant with this CCI because they are covered at the DoD CP-1 CP-1 (a) (1) CCI-000439 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP Automatically compliant with this CCI because they are covered at the DoD level CP-1 CP-1 (a) (2) CCI-002826 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all stakeholders identified in the contingency plan. Automatically compliant with this CCI because they are covered at the DoD CP-1 CP-1 (a) (2) CCI-000441 High Moderate Low High Moderate Low High Moderate Low DoDI 8500.01 and NIST SP 800-34 meet the DoD requirements for contingency planning policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8500.01 and NIST SP Automatically compliant with this CCI because they are covered at the DoD level
CP-2 (3) CP-2 (3) CCI-000473 High Moderate The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan. Automatically compliant with this CCI because they are covered at the DoD level CP-2 (3) CP-2 (3) CCI-000474 High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the time period as 1 hour (Availability High) 12 hours (Availability Moderate) as defined in the contingency plan. Automatically compliant with this CCI because they are covered at the DoD level CP-2 (4) CP-2 (4) CCI-000479 High The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for full resumption of affected missions within 1 hour (Availability High ) 1-5 days (Availability Moderate) 5-30 days (Availability Low) as defined in the contingency plan. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-2 (4) CP-2 (4) CCI-000480 High The organization conducting the inspection/assessment obtains the contingency plan to ensure it contains procedures for full resumption of affected business functions within 1 hour (Availability High) days (Availability Moderate) 5-30 days (Availability Low) as defined in the contingency plan. The system is not considered a HIGH level. Therefore, this AP is not applicable.
CP-7 (1) CP-7 (1) CCI-000516 High Moderate The organization conducting the inspection/assessment obtains and examines the risk management strategy and the contingency plan to ensure the organization identifies an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same threats identified at the primary site. The system is not considered a MODERATE or HIGH level for Availability. CP-7 (2) CP-7 (2) CCI-000517 High Moderate The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster. The system is not considered a MODERATE or HIGH for Availability. CP-7 (2) CP-7 (2) CCI-001606 High Moderate The organization conducting the inspection/assessment obtains and examines the contingency plan to ensure the organization has documented explicit mitigation actions for accessibility problems identified in CP-7 (2), CCI 517 to the alternate processing site in the of an area-wide disruption or disaster. The system is not considered a MODERATE or HIGH level for Availability. CP-7 (3) CP-7 (3) CCI-000518 High Moderate The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure they contain priority-of-service provisions in accordance with CP-2, CCI 447 for alternate processing site support (including recovery time objectives). The system is not considered a MODERATE or HIGH level for Availability. CP-7 (4) CP-7 (4) CCI-000519 High The organization conducting the inspection/assessment obtains and examines the contingency plan and conducts a walk-through of the alternate processing site to ensure it is ready to be used as the operational site supporting essential missions. The system is not considered a HIGH level. Therefore, this AP is not applicable.
CP-7 (4) CP-7 (4) CCI-000520 High The organization conducting the inspection/assessment obtains and examines the contingency plan and conducts a walk-through of the alternate processing site to ensure it is to be used as the operational site supporting business functions. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-7 (6) CP-7 (6) CCI-002837 blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed plans for circumstances that preclude returning to the primary processing site. NIST has not allocated this AP. Therefore, this AP is not applicable. CP-7 (6) CP-7 (6) CCI-002838 blank blank blank The organization conducting the inspection/assessment obtains and examines system resource or agreements with external support providers to ensure the organization being inspected/assessed prepares for circumstances that preclude returning to the primary processing site. NIST has not allocated this AP. Therefore, this AP is not applicable. CP-7 CP-7 (a) CCI-000513 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure the organization has alternate processing site support that will permit the transfer and resumption of information system operations for essential missions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan. The system is not considered a MODERATE or HIGH level for Availability.
CP-7 CP-7 (a) CCI-000514 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the approved alternate processing site agreements to ensure the organization has alternate processing site support that will permit the transfer and resumption of information system operations for business functions within 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan. The system is not considered a MODERATE or HIGH level for Availability. CP-7 CP-7 (a) CCI-002839 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment obtains and examines the documented information system operations to ensure the organization inspected/assessed defines information system operations that are permitted to transfer and resume at an alternate processing sites for essential missions/business functions when the primary processing capabilities are unavailable. DoD has determined the information system operations are not appropriate to define at the Enterprise level. The system is not considered a MODERATE or HIGH level for Availability. CP-7 CP-7 (a) CCI-000510 High Moderate High Moderate High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan Automatically compliant with this CCI because they are covered at the DoD level
CP-8 CP-8 CCI-000525 High Moderate The organization conducting the inspection/assessment obtains and examines the approved alternate telecommunications service agreements to ensure they permit the resumption of telecommunications services for business functions IAW DoDI 8100.04. DoD has defined the time period as 1 hour (Availability High ) 12 hours (Availability Moderate) as defined in the contingency plan. The system is not considered a MODERATE or HIGH level for Availability. CP-8 CP-8 CCI-002840 High Moderate The organization conducting the inspection/assessment obtains and examines the documented information system operations to ensure the organization inspected/assessed defines the information system operations to be resumed for essential missions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. DoD has determined the information system operations are not appropriate to define at the Enterprise level. The system is not considered a MODERATE or HIGH for Availability.
services are provided by a common carrier. CP-8 (2) CP-8 (2) CCI-000530 High Moderate The organization conducting the inspection/assessment obtains and examines agreements with their service providers to ensure that a single point of failure is not shared. The system is not considered a MODERATE or HIGH for Availability. CP-8 (3) CP-8 (3) CCI-000531 High The organization conducting the inspection/assessment obtains and examines agreements with alternate service providers to ensure they are not susceptible to the same hazards as the primary service provider. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-8 (4) CP-8 (4) (a) CCI-000532 High The organization conducting the inspection/assessment obtains and examines the primary telecommunications service provider agreements to ensure the organization requires the primary service provider to have contingency plans. The system is not considered a HIGH Therefore, this AP is not applicable. CP-8 (4) CP-8 (4) (a) CCI-000533 High The organization conducting the inspection/assessment obtains and examines the alternate telecommunications service provider agreements to ensure the organization requires the alternate service provider to have contingency plans. The system is not considered a HIGH Therefore, this AP is not applicable.
CP-8 (4) CP-8 (4) (b) CCI-002842 High The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed reviews provider contingency plans to ensure that the plans meet organizational contingency requirements. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-8 (4) CP-8 (4) (c ) CCI-002845 High The organization conducting the inspection/assessment obtains and examines the evidence of contingency testing to ensure that the organization being inspected/assessed obtains evidence that contingency testing is conducted by providers at least annually. DoD has defined the frequency as at least annually. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-8 (4) CP-8 (4) (c ) CCI-002846 High The organization conducting the inspection/assessment obtains and examines the evidence of contingency training to ensure that the organization being inspected/assessed obtains evidence that contingency training is conducted by providers at least annually. DoD has defined the frequency as at least annually. The system is not considered a HIGH level. Therefore, this AP is not applicable. CP-8 (4) CP-8 (4) (c ) CCI-002843 High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD level CP-8 (4) CP-8 (4) (c ) CCI-002844 High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD