PS-1 PS-1 (a) CCI-003018 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the roles as organizational personnel with access control responsibilities. Automatically compliant with this CCI because they are covered at the DoD level PS-1 PS-1 (a) (1) CCI-001504 High Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R. Automatically compliant with this CCI because they are covered at the DoD level PS-1 PS-1 (a) (1) CCI-001505 High Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R. Automatically compliant with this CCI because they are covered at the DoD level PS-1 PS-1 (a) (2) CCI-001509 High Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R. Automatically compliant with this CCI because they are covered at the DoD level PS-1 PS-1 (a) (2) CCI-001510 High Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R. Automatically compliant with this CCI because they are covered at the DoD level
PS-4 PS-4 (c ) CCI-003024 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented information security topics to ensure the organization being inspected/assessed defines information security topics to be discussed while conducting exit interviews. DoD has determined the information security topics are not appropriate to define at the Enterprise level. PS-4 PS-4 (c ) CCI-001523 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of departed personnel and the audit trail of conducted exit interviews to ensure all departed personnel had exit interviews conducted that include a discussion of information security topics defined in PS-4, CCI 3024. PS-4 PS-4 (d) CCI-001524 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines appropriate organization security-related organizational information systems-related property documentation/logs and compares to audit trail of all retrieved organizational information property (AU-2) to ensure all property has been retrieved. PS-4 PS-4 (e ) CCI-001525 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment interviews appropriate IT and security personnel to validate the organization has procedures in place which, upon termination of individual's employment, will ensure it retains access to organizational information formerly controlled by the terminated individual.
PS-6 PS-6 (b) CCI-001533 High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD level PS-6 PS-6 (c ) (1) CCI-001531 High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains a list of organizational individuals with active accounts and validates the existence of signed DD Form 2875 (paper or electronic) associated with a sampling of individuals selected from the list. PS-6 PS-6 (c ) (2) CCI-003036 High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines a sampling of re-signed access agreements to ensure the organization being inspected/assessed requires that individuals re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or when there is a change to the user's level of access. DoD has defined the frequency as when there is a change to the user's level of access. PS-6 PS-6 (c ) (2) CCI-003037 High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as when there is a change to the user's level of access. Automatically compliant with this CCI because they are covered at the DoD level
PS-7 PS-7 (d) CCI-003041 High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization inspected/assessed requires third-party providers to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately. DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials. DoD has defined the time period as immediately. PS-7 PS-7 (d) CCI-003042 High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials. Automatically compliant with this CCI because they are covered at the DoD level PS-7 PS-7 (d) CCI-003043 High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the time period as immediately. Automatically compliant with this CCI because they are covered at the DoD PS-7 PS-7 (e ) CCI-001541 High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring activity to ensure the organization being inspected/assessed monitors third-party provider compliance with personnel security requirements.
ENCLOSURE 1 – POSITION DESIGNATION AUTHORIZED POSITION DESIGNATIONS Position Designation Applicable Investigation/Form Last Reviewed Low Risk Non-Sensitive NACI SF-85 {REVIEW_DATE} Moderate Risk Non-Sensitive (Public Trust) MBI SF-85P {REVIEW_DATE} High Risk Non-Sensitive (Public BI (SF-85P) {REVIEW_DATE} Low Risk Non-Critical Sensitive ANACI or NACLC (SF-86) {REVIEW_DATE} Moderate Risk Non-Critical Sensitive MBI (SF-86) {REVIEW_DATE} High Risk Non-Critical Sensitive SSBI (SF-86) *Note- access is still Secret even though investigation is an SSBI. {REVIEW_DATE} Critical Sensitive (automatic high risk) SSBI (SF-86) {REVIEW_DATE} Special Sensitive (automatic high risk) SSBI (SF-86) {REVIEW_DATE}