APPENDIX A – DETAILED COMPLIANCE MATRIX The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations". Control Number Assessment Number CCI Confidentiality Integrity Availability Assessment Procedures Reference SA-1 SA-1 (a) CCI-003089 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all personnel. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) CCI-003090 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as all personnel. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) (1) CCI-000602 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. Automatically compliant with this CCI because they are covered at the DoD level SA-1 SA-1 (a) (1) CCI-000603 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. Automatically compliant with this CCI because they are covered at the DoD SA-1 SA-1 (a) (2) CCI-000605 High Moderate Low High Moderate Low High Moderate Low DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1 meet the DoD requirements for system and services acquisition policy and procedures. Automatically compliant with this CCI because they are covered at the DoD level
policies, DoDD 5000.01, DoDI 5000.02, and DoDI 8580.1. SA-10 (1) SA-10 (1) CCI-000698 High Moderate Low The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of software and firmware components. SA-10 (2) SA-10 (2) CCI-000700 blank blank The organization conducting the inspection/assessment obtains and examines the Configuration Control Board (CCB) charter to determine if the organization, in the absence of a dedicated software developer configuration management team, has established an alternate configuration management process that is staffed with key organizational personnel. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (3) SA-10 (3) CCI-003165 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service enable integrity verification of hardware components. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (4) SA-10 (4) CCI-003166 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-10 (4) SA-10 (4) CCI-003167 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed NIST has not allocated this AP. Therefore, this AP is not applicable.
component received is genuine and has not been altered. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. SA-12 (10) SA-12 (10) CCI-003213 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined IAW DoDI 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (11) SA-12 (11) CCI-003214 High High High The organization conducting the inspection/assessment obtains and examines the documented processes to ensure the organization inspected/assessed employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of supply chain elements, processes and actors defined in SA-12 (11), CCI 3215 associated with the information system, system component, or information system service. The system is not considered a HIGH Therefore, this AP is not applicable. SA-12 (11) SA-12 (11) CCI-003215 High High High The organization conducting the inspection/assessment obtains and examines the documented supply chain elements, processes, and actors to ensure the organization being inspected/assessed defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing IAW DoDI 5200.44. DoD has determined the elements, processes, and actions are not appropriate The system is not considered a HIGH level. Therefore, this AP is not applicable.
inspected/assessed retains unique identification of supply chain elements, processes, and actors. SA-12 (15) SA-12 (15) CCI-003224 blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (2) SA-12 (2) CCI-003200 blank blank The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of supplier review to ensure the organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-12 (5) SA-12 (5) CCI-003201 High High High The organization conducting the inspection/assessment obtains and examines the record of security safeguards supplied to ensure the organization inspected/assessed employs security safeguards defined in SA-12 (5), CCI 3202 to limit harm from potential adversaries identifying and targeting the organizational supply chain. The system is not considered a HIGH Therefore, this AP is not applicable. SA-12 (5) SA-12 (5) CCI-003202 High High High The conducting the inspection/assessment obtains and examines the documented security safeguards to ensure they have been defined IAW DoDI 5200.44. DoD has determined the security safeguards are not appropriate to define at the Enterprise The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-12 (7) SA-12 (7) CCI-003203 blank blank blank The organization conducting the inspection/assessment obtains and examines documented assessment(s) that were conducted by the NIST has not allocated this AP. Therefore, this AP is not applicable.
appropriate to define at the Enterprise level. SA-14 SA-14 CCI-003229 High High High The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization inspected/assessed identifies critical information system components by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-14 SA-14 CCI-003230 High High High The organization conducting the inspection/assessment obtains and examines the documented information system functions to ensure the organization being inspected/assessed identifies critical information system functions by performing a criticality analysis for information systems, information system components, or information system services IAW DoDI 5200.44. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-14 SA-14 CCI-003231 High High High The organization conducting the inspection/assessment obtains and examines the documented information systems, information system components, or information system services to ensure they have been defined IAW DoDI 5200.44. DoD has determined the information systems, information system components, or information system services are not appropriate to define at the Enterprise level. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-14 SA-14 CCI-003232 High High High The organization conducting the inspection/assessment obtains and examines the documented decision points to ensure they have been defined IAW DoDI 5200.44 and DoDI 5000.2. DoD has determined the decision points are not appropriate to define at the Enterprise level. The system is not considered a HIGH level. Therefore, this AP is not applicable.
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service determine the exploitation potential for discovered vulnerabilities. HIGH level. Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (c) CCI-003278 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service determine potential risk mitigations for delivered vulnerabilities. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (d) CCI-003279 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service deliver the outputs of the tools and results of the vulnerability analysis to the ISSO, ISSM, and PM. DoD has defined the personnel or roles as the ISSO, ISSM, and PM. The system is not considered a HIGH Therefore, this AP is not applicable. SA-15 (7) SA-15 (7) (d) CCI-003280 High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as the ISSO, ISSM, and PM. Automatically compliant with this CCI because they are covered at the DoD SA-15 (8) SA-15 (8) CCI-003281 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service use threat modeling from similar systems, NIST has not allocated this AP. Therefore, this AP is not applicable.
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (c) CCI-003326 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (c) CCI-003327 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (d) CCI-003328 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to hardware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (d) CCI-003329 blank blank blank The organization conducting the inspection/assessment NIST has not allocated this AP.
obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to software. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (d) CCI-003330 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer of the information system, system component, or information system service show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (e) CCI-003331 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the hardware. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-17 (4) SA-17 (4) (e) CCI-003332 blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of the information system, system component, or information system service describe the software mechanisms not addressed in the descriptive top-level specification but strictly internal to the software. NIST has not allocated this AP. Therefore, this AP is not applicable.
system service structure security-relevant firmware to facilitate controlling access with least privilege. SA-17 SA-17 (a) CCI-003294 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is interrogated part of the organization's enterprise architecture. The system is not considered a HIGH Therefore, this AP is not applicable. SA-17 SA-17 (b) CCI-003295 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the required security functionality. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-17 SA-17 (b) CCI-003296 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components. The system is not considered a HIGH Therefore, this AP is not applicable. SA-17 SA-17 (c) CCI-003297 High High High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. The system is not considered a HIGH level. Therefore, this AP is not applicable.
obtains and examines the documented indications to ensure the organization inspected/assessed defines indications of need for inspection to detect tampering during inspections of information systems, system components, or devices. DoD has determined the indications are not appropriate to define at the Enterprise level. Therefore, this AP is not applicable. SA-19 (1) SA-19 (1) CCI-003367 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented process, the list of personnel responsible for detecting counterfeit information system components, as well as the record of training to ensure the organization being inspected/assessed trains personnel or roles defined in SA-19 (1), CCI 3368 to detect counterfeit information system components (including hardware, software, and firmware). NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (1) SA-19 (1) CCI-003368 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware). DoD has determined the personnel or roles are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (2) SA-19 (2) CCI-003369 blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains configuration control l over information system components defined in SA-19 (2), CCI 3370 awaiting service/repair. NIST has not allocated this AP. Therefore, this AP is not applicable.
SA-19 (2) SA-19 (2) CCI-003370 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components awaiting service/repair in which configuration control must be maintained. DoD has determined the information system components are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (2) SA-19 (2) CCI-003371 blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed maintains configuration control over serviced/repaired components awaiting return to service. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (3) SA-19 (3) CCI-003391 blank blank The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of disposal to ensure the organization inspected/assessed disposes of information system components using techniques and methods defined IAW DoD Manual 5200.01. DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 (3) SA-19 (3) CCI-003390 blank blank The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the techniques and methods as defined IAW DoD Manual 5200.01. Automatically compliant with this CCI because they are covered at the DoD level SA-19 (4) SA-19 (4) CCI-003388 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed NIST has not allocated this AP. Therefore, this AP is not applicable.
defines the frequency to scan for counterfeit information system components. DoD has determined the frequency is not appropriate to define at the Enterprise level. SA-19 (4) SA-19 (4) CCI-003389 blank blank The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of scans to ensure the organization being inspected/assessed scans for counterfeit information system components in accordance with the frequency defined in SA-19 (4), CCI 3388. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-19 SA-19 (a) CCI-003356 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit policy to ensure the organization inspected/assessed develops an anti-counterfeit policy that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003357 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit policy to ensure the organization being inspected/assessed develops an anti-counterfeit policy that include the means to prevent counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003358 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit procedures to ensure the organization being inspected/assessed develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system. SA-19 SA-19 (a) CCI-003359 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented anti-counterfeit procedures to ensure the organization being
SA-2 SA-2 (b) CCI-000611 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has documented the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (b) CCI-000612 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has allocated the resources required for cybersecurity requirements to protect the information system or information system service. SA-2 SA-2 (c) CCI-000613 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-2 SA-2 (c) CCI-000614 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the planning, programming, and budget documentation to ensure the organization being inspected/assessed has identified and established an individual line item for cybersecurity requirements to protect the information system. SA-20 SA-20 CCI-003386 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented critical information system components to ensure the organization being inspected/assessed defines the critical information system components to or custom develop. NIST has not allocated this AP. Therefore, this AP is not applicable.
DoD has determined the critical information system components are not appropriate to define at the Enterprise level. SA-20 SA-20 CCI-003387 blank blank blank The organization conducting the inspection/assessment obtains and examines hardware and software lists to ensure that no commercial off-the-shelf components are used as critical information system components defined in CCI 3386. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 CCI-003384 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented information system, system component, or information system service to ensure the organization being inspected/assessed defines the information system, system component, or information system service which require the information system developer to have appropriate access authorizations and satisfy additional personnel screening criteria. DoD has determined the information system, system component, or information system service is not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003377 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented actions to ensure the organization inspected/assessed defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003378 blank blank The organization conducting the inspection/assessment obtains and examines the documented actions to NIST has not allocated this AP. Therefore, this
ensure the organization inspected/assessed defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied. DoD has determined the actions are not appropriate to define at the Enterprise level. AP is not applicable. SA-21 (1) SA-21 (1) CCI-003379 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3377 to ensure the required screening criteria are satisfied. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 (1) SA-21 (1) CCI-003380 blank blank blank The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires that the developer of information system, system component, or information system service take actions defined in SA-21 (1), CCI 3378 to ensure the required access authorizations are satisfied. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 (a) CCI-003383 blank blank The organization conducting the inspection/assessment obtains and examines the documented official government duties to ensure the organization being inspected/assessed defines the official government duties to be assigned to the developer of information system, system component, or information system service. DoD has determined the official government duties are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-21 SA-21 (a) CCI-003385 blank blank The organization conducting the inspection/assessment NIST has not allocated this AP.
to define at the Enterprise level. SA-22 (1) SA-22 (1) CCI-003373 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization inspected/assessed provides in-house support and/or support from external providers defined in SA-22 (1), CCI 3372 for unsupported information system components. NIST has not allocated this AP. Therefore, this AP is not applicable. SA-22 SA-22 (a) CCI-003376 High High High The organization conducting the inspection/assessment obtains and examines the documented process as well as the hardware and software lists to ensure the organization being inspected/assessed replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-22 SA-22 (b) CCI-003374 High High High The organization conducting the inspection/assessment obtains and examines the hardware and software lists as well as the documented approvals to ensure the organization being inspected/assessed documents approval for the continued use of unsupported system components required to satisfy mission/business needs. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-22 SA-22 (b) CCI-003375 High High High The organization conducting the inspection/assessment obtains and examines the documented justification as well as the hardware and software lists to ensure the organization being inspected/assessed provides justification for the continued use of unsupported system components required to satisfy mission/business needs. The system is not considered a HIGH Therefore, this AP is not applicable. SA-3 SA-3 (a) CCI-003092 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented system development life to ensure the organization being inspected/assessed
defines the level of detail the implementation information of the security controls is required to be provided by the developer of the information system, system component, or information system services. DoD has determined the level of detail is not appropriate to define at the Enterprise level. SA-4 (3) SA-4 (3) CCI-003107 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes defined in SA-4 (3), CCI 3108. The system is not considered a HIGH level. Therefore, this AP is not applicable. SA-4 (3) SA-4 (3) CCI-003108 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization being inspected/assessed defines the system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service needs to include when demonstrating the use of a system development life cycle. The system is not considered a HIGH Therefore, this AP is not applicable. SA-4 (5) SA-4 (5) (a) CCI-003109 High The organization conducting the inspection/assessment obtains and examines the contracts/agreements to ensure the organization inspected/assessed requires he developer of the information system, system component, or information The system is not considered a HIGH Therefore, this AP is not applicable.
this CCI because they are covered at the DoD level. DoD has defined the personnel or roles as at a minimum, the ISSO, ISSM, and SCA. they are covered at the DoD level SA-8 SA-8 CCI-000664 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the system requirements documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the specification of the information system. SA-8 SA-8 CCI-000665 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the design documents to ensure that the organization being inspected/assessed applies information system security engineering principles in the design of the information system. SA-8 SA-8 CCI-000666 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the system development procedures (e.g. configuration management plans, code review procedures, and coding style guides) to ensure that the organization being inspected/assessed applies information system security engineering principles in the development of the information system. SA-8 SA-8 CCI-000667 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trail artifacts that were created during the implementation of SA-8, CCI 000666 to ensure that the organization being inspected/assessed applies information system security engineering principles in the implementation of the information system and that changes are made IAW the configuration management plan (CM-9, CCI 001790). SA-8 SA-8 CCI-000668 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the