7.0 CENTRAL MANAGEMENT {ACRONYM} is automatically compliant with this requirement because they are covered at the DoD level. DoDI 8500.01, DoDI 8510.01, and CNSSI 1253 meet the DoD requirements for centrally managing security controls and related processes. APPENDIX A – DETAILED COMPLIANCE MATRIX The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations". Control Number Assessment Number CCI Confidentiality Integrity Availability Assessment Procedures Reference PL-1 PL-1 (a) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has the roles as Organizational personnel with planning responsibilities or information security responsibilities. Automatically compliant with this CCI because they are covered at the DoD level PL-1 PL-1 (a) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the roles as Organizational personnel with planning responsibilities or information security responsibilities. Automatically compliant with this CCI because they are covered at the DoD PL-1 PL-1 (a) (1) High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level
PL-1 PL-1 (a) (1) High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01. DoD has defined the roles as organizational personnel with planning responsibilities or information security responsibilities. Automatically compliant with this CCI because they are covered at the DoD level PL-1 PL-1 (a) (2) High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PL-1 PL-1 (b) (1) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance. Automatically compliant with this CCI because they are covered at the DoD level PL-1 PL-1 (b) (1) High Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the requirements for a security planning policy. DoD Components are automatically compliant with this CCI because they are covered by DoD level policy, DoDI 8510.01. DoD has defined the frequency as every 5 years. Automatically compliant with this CCI because they are covered at the DoD level PL-1 PL-1 (b) (2) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD
PL-2 PL-2 (a) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security plan to ensure the organization being inspected/assessed develops a security plan for the information system. eMASS SSP PL-2 PL-2 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan and the enterprise architecture to ensure the organization's security plan for the information system is consistent with the organization's enterprise architecture. eMASS SSP PL-2 PL-2 (a) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed explicitly defines within the security plan the authorization boundary for the system. eMASS SSP PL-2 PL-2 (a) (3) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization inspected/assessed describes within the security plan the operational context of the information system in terms of missions and business processes. eMASS SSP PL-2 PL-2 (a) (4) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed defines within the security plan the security categorization of the information system including supporting rationale. eMASS SSP PL-2 PL-2 (a) (5) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed describes within the security plan the operational environment for the information system and relationships with or connections to other information systems. eMASS SSP
PL-2 PL-2 (b) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security plan via the organization's information sharing portal to ensure the organization being inspected/assessed distributes copies of the security plan to at a minimum, the ISSO, ISSM and SCA via the organization's information sharing portal. DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA. eMASS SSP PL-2 PL-2 (b) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA. Automatically compliant with this CCI because they are covered at the DoD level PL-2 PL-2 (b) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM and SCA. Automatically compliant with this CCI because they are covered at the DoD PL-2 PL-2 (c ) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit records of security plan reviews to verify the security plan has been reviewed annually. DoD has defined the frequency as annually. eMASS SSP PL-2 PL-2 (c ) High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD
PL-8 PL-8 (a) (1) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information. eMASS SSP PL-8 PL-8 (a) (2) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, how the information security architecture is integrated into and supports the enterprise architecture. eMASS SSP PL-8 PL-8 (a) (3) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the information security architecture to ensure the organization being inspected/assessed describes within the information security architecture for the information system, any information security assumptions about, and dependencies on, external services. eMASS SSP PL-8 PL-8 (b) High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information security architecture annually to reflect updates in the enterprise architecture. DoD has defined the frequency as annually. eMASS SSP