PM-1 PM-1 (a) (4) CCI-002988 Low Moderate High Low Moderate High Low Moderate High DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service. If the organization or system owner is utilizing common controls, they must be documented in their Security Plan. Automatically compliant with this CCI because they are covered at the DoD level PM-1 PM-1 (b) CCI-000076 Low Moderate High Low Moderate High Low Moderate High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD level PM-1 PM-1 (b) CCI-000075 Low Moderate High Low Moderate High Low Moderate High DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service. If the organization or system owner is utilizing common controls, they must be documented in their Security Plan. Automatically compliant with this CCI because they are covered at the DoD level PM-1 PM-1 (c) CCI-000077 Low Moderate High Low Moderate High Low Moderate High DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service. If the organization or system owner is utilizing common controls, they must be documented in their Security Plan. Automatically compliant with this CCI because they are covered at the DoD level
PM-1 PM-1 (d) CCI-002989 Low Moderate High Low Moderate High Low Moderate High DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service. If the organization or system owner is utilizing common controls, they must be documented in their Security Plan. Automatically compliant with this CCI because they are covered at the DoD level PM-1 PM-1 (d) CCI-002990 Low Moderate High Low Moderate High Low Moderate High DoD components are automatically compliant with this CCI as they are covered at the DoD level by DoDI 8500.01 and the Knowledge Service. If the organization or system owner is utilizing common controls, they must be documented in their Security Plan. Automatically compliant with this CCI because they are covered at the DoD PM-10 PM-10 (a) CCI-000229 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to manage the security authorization process. DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PM-10 PM-10 (a) CCI-000230 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to manage the security authorization process. DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level
PM-10 PM-10 (a) CCI-000231 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 the DoD requirement to manage the security authorization process. DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PM-10 PM-10 (b) CCI-000233 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to designate roles and responsibilities for the risk management process. DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PM-10 PM-10 (c) CCI-000234 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to fully integrate the security authorization process. DoD components are automatically compliant with this CCI because they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PM-11 PM-11 (a) CCI-000235 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 meets the DoD requirement to define mission/business processes. DoD components are automatically complaint with this control as they are covered at the DoD level, DoDI 8510.01. Automatically compliant with this CCI because they are covered at the DoD level PM-11 PM-11 (b) CCI-000236 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines the security plan to ensure the security categorization has been documented IAW CNSSI 1253.
PM-14 PM-14 (b) CCI-003007 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. PM-14 PM-14 (b) CCI-003008 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. PM-14 PM-14 (b) CCI-003009 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of reviews to ensure the organization being inspected/assessed reviews monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
PM-3 PM-3 (c) CCI-000141 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed ensure that information security resources are available for expenditure as planned. PM-4 PM-4 (a) (1) CCI-002991 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to develop a process for plans of action and milestones for the security program. DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service. Automatically compliant with this CCI because they are covered at the DoD level PM-4 PM-4 (a) (1) CCI-000142 Low Moderate High Low Moderate High Low Moderate High DoDI 8510.01 and the Knowledge Service meet the DoD requirements to maintain a process for plans of action and milestones for the security program. DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01 and the Knowledge Service. Automatically compliant with this CCI because they are covered at the DoD
PM-6 PM-6 CCI-000210 Low Moderate High Low Moderate High Low Moderate High The Federal Information Systems Management Act (FISMA) meets the DoD requirements for information security performance measures of performance. DoD organizations are automatically compliant with this control as they are covered at the DoD level by FISMA. Automatically compliant with this CCI because they are covered at the DoD level PM-6 PM-6 CCI-000211 Low Moderate High Low Moderate High Low Moderate High The organization conducting the inspection/assessment obtains and examines reporting documentation. PM-7 PM-7 CCI-000212 Low Moderate High Low Moderate High Low Moderate High The GIG IA Architecture meets the DoD requirements for enterprise architecture. DoD components are automatically compliant with this CCI as they covered at the DoD level. Automatically compliant with this CCI because they are covered at the DoD level PM-8 PM-8 CCI-000216 Low Moderate High Low Moderate High Low Moderate High DoDD 3020.40 the DoD requirement for the development of a critical infrastructure and key resource protection plan. DoD components are automatically compliant with this control as they are covered by the DoD level, DoDD 3020.40. Automatically compliant with this CCI because they are covered at the DoD PM-8 PM-8 CCI-001640 Low Moderate High Low Moderate High Low Moderate High DoDD 3020.40 meets the DoD requirement for the development of a critical infrastructure and key resource protection plan. DoD components are automatically compliant with this control as they are covered by the DoD level, DoDD 3020.40. Automatically compliant with this CCI because they are covered at the DoD level
ID Goal Measure Measure Type Formula Target Evidence Frequency Responsibility Data Source Ensure all vulnerabilities are identified and mitigated Percentage (%) of high vulnerabilities mitigated within organizationally defined time periods after discovery Effectiveness/Efficiency (# of high vulnerabilities identified and mitigated within targeted time during the time period /number of high vulnerabilities identified within the time period) *100 100% 1. Number of high vulnerabilities identified. 2. Number of high vulnerabilities mitigated. Collection Frequency: Monthly Reporting Frequency: Monthly ISSO ACAS Scans VRAM AT-001 Ensure that organization personnel are adequately trained to carry out their assigned information security-related duties and responsibilities Percentage (%) of information system security personnel that have received security training. Implementation (Number of information system security personnel that have completed security training within the past year/total number of information system security personnel) *100 100% 1. Number of personnel completing required training Collection Frequency: Yearly Reporting Frequency: Yearly ISO ISSO Training and awareness tracking records Create, protect, and retain information system records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate activity Average frequency of audit records review and analysis for inappropriate activity Effectiveness/Efficiency Average frequency during reporting period 100% 1. Is logging set per STIG? 2. Are audit logs reviewed daily? Collection Frequency: Daily Reporting Frequency: Monthly ISSO Audit log reports CA-001 Ensure all information systems have been certified and accredited as required. Percentage (%) of systems that have completed certification and accreditation Effectiveness/Efficiency (Number of systems with complete C&A packages with Authorizing Official [AO] approval/(total number of new systems) *100 100% 1. Is the system accredited? Collection Frequency: Monthly Reporting Frequency: Monthly ISSO ATO Letter
Establish and maintain baseline configurations throughout the system lifecycle. Percentage (%) approved and implemented configuration changes identified Implementation (Number of approved and implemented configuration changes identified/total number of configuration changes identified through automated scans) *100 100% 1. Have all changes been documented? Collection Frequency: Quarterly Reporting Frequency: Quarterly ISO ISSO Change Requests Scans CP-001 Establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations Percentage (%) of information systems that have conducted annual contingency plan testing Effectiveness/Efficiency (Number of information systems that have conducted annual contingency plans testing/number of information systems in the system inventory) *100 100% 1. has the Contingency Plan been exercise? Collection Frequency: Yearly Reporting Frequency: Yearly ISO ISSO CP Test Artifact Lessons Learned IA-001 All system are identified and authenticated using PKI Percentage (%) of users with CAC access Effectiveness/Efficiency (Number of users with CAC-based accounts/total number of users) *100 100% 1. Are all authenticated with CAC? Collection Frequency: Quarterly Reporting Frequency: Quarterly ISO ISSO Scans Interview IR-001 Track, document, and report incidents to appropriate organizational officials and/or authorities Percentage (%) of incidents reported within required time per applicable incident category Effectiveness/Efficiency For each incident category (number of incidents reported on time/total number of reported incidents) *100 100% 1. all incidents reported? Collection Frequency: As Needed Reporting Frequency: Yearly ISO ISSO Actions Report Lessons Learned
PE-001 Ensure that individuals occupying positions of responsibility within organizations are trustworthy and meet established security criteria for those positions. Percentage (%) of individuals screened before being granted access to system. Implementation (Number of individuals number of individuals with access) *100 100% 1. How many individuals have been granted access to the system? 2. What is the number of individuals who have completed personnel screening? Collection Frequency: As Needed Reporting Frequency: Yearly ISO ISSO SAAR Form