RA-1 RA-1 (b) (2) CCI-001044 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy. DoD has defined the frequency as annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level RA-2 RA-2 (a) CCI-001045 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed categorizes information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. RA-2 RA-2 (b) CCI-001046 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented security categorization results to ensure the organization being inspected/assessed documents the security categorization results (including supporting rationale) in the security plan for the information system IAW CNSSI 1253. RA-2 RA-2 (c) CCI-001047 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensures the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.
RA-3 RA-3 (a) CCI-001048 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail of assessments to ensure the organization being inspected/assessed conducts an assessment of risk of the information system and the information it processes, stores, or transmits that includes the likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction. RA-3 RA-3 (b) CCI-001049 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the risk assessment report to ensure the organization being inspected/assessed documents risk assessment results in the risk assessment report. DoD has defined the document as a risk assessment report. RA-3 RA-3 (b) CCI-001642 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the document as a risk assessment report. Automatically compliant with this CCI because they are covered at the DoD RA-3 RA-3 (c) CCI-001050 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the record of reviews to ensure the organization inspected/assessed reviews risk assessment results upon DoD has defined the frequency as upon
RA-3 RA-3 (c) CCI-001051 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as upon Automatically compliant with this CCI because they are covered at the DoD level RA-3 RA-3 (d) CCI-002370 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disseminates the risk assessment results to the ISSM, ISSO, AO, and PM. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. RA-3 RA-3 (d) CCI-002371 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM. Automatically compliant with this CCI because they are covered at the DoD level RA-3 RA-3 (e ) CCI-001052 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines historical versions of the risk assessment as well as records of changes to the system to ensure the organization being inspected/assessed updates the risk assessment upon or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system. DoD has defined the frequency as upon