CA-1 CA-1 (b) (1) High Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level CA-1 CA-1 (b) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the trail of review and update activity to ensure the organization being inspected/assessed reviews and updates, IAW DoDI 8510.01, the current security assessment and authorization procedures annually. CA-1 CA-1 (b) (2) High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD level CA-2 (1) CA-2 (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the level of independence defined in CA-2 (1), CCI 2064 to ensure that they, as the assessor, meet the required level of independence.
CA-2 (2) CA-2 (2) High High High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD level CA-2 (3) CA-2 (3) blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information systems to ensure the organization being inspected/assessed defines the information systems for which they will accept the results of an assessment performed by an external organization. DoD has determined the information systems are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable.
CA-2 (3) CA-2 (3) blank blank The organization conducting the inspection/assessment obtains and examines a sampling of records of acceptance or rejection of external organization assessment results to ensure the organization inspected/assessed accepts the results of an assessment of the information system defined in CA-2 (3), CCI 2067 performed by external organization defined in CA-2 (3), CCI 2068 when the assessment meets requirements defined in CA-2 (3), CCI 2069. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-2 CA-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the Security Plan to validate *security assessment blocks* are complete. CA-2 CA-2 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains the security assessment plan to verify the plan identifies the security controls and those control enhancements under assessment.
CA-3 (1) CA-3 (1) High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the unclassified, national security systems as all unclassified NSS. Automatically compliant with this CCI because they are covered at the DoD level
CA-3 (3) CA-3 (3) blank blank blank The organization conducting the inspection/assessment obtains and examines network topology diagrams and examines the information system to ensure the organization being inspected/assessed does not connect any national security systems to an external network without the use of protection devices defined in CA-3 (3), CCI 2077. NIST has not allocated this AP. Therefore, this AP is not applicable.
CA-3 (5) CA-3 (5) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the information systems as any systems requiring external connectivity. Automatically compliant with this CCI because they are covered at the DoD level
CA-3 (5) CA-3 (5) High Moderate Low High Moderate Low The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ a deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2080. DoD has defined the information systems as any systems requiring external connectivity.
CA-3 CA-3 (c) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least annually. Automatically compliant with this CCI because they are covered at the DoD level CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable. CA-5 (1) CA-5 (1) blank blank blank The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. NIST has not allocated this AP. Therefore, this AP is not applicable.
CA-7 (1) CA-7 (1) High Moderate High Moderate High Moderate Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 (1) CA-7 (1) High Moderate High Moderate High Moderate Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 (3) CA-7 (3) blank blank blank Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (a) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (b) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (b) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (c) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (d) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published
CA-7 CA-7 (e) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (f) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (g) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (g) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published CA-7 CA-7 (g) High Moderate Low High Moderate Low High Moderate Low Future DoD-wide CM guidance to be published N/A. Awaiting future CM guidance to be published