PL-2 System Security Plan Annual/ Annual Annual/ Annual Annual/ Annual L L L RA-5 Vulnerability Scanning Quarterly/ Annual Quarterly/ Annual Quarterly/ Annual L L L SA-15 Development Process, Standards, and Annual/ Annual Annual/ Annual Annual/ Annual L L L SC-5 Denial of Service Protection Annual/ Annual Annual/ Annual Annual/ Annual L SC-7 Boundary Protection Monthly/ Annual Quarterly/ Annual Annual/ Annual L L SC-8 Transmission Confidentiality and Integrity Semi Annual/ Annual Annual/ Annual Annual/ Annual L L SC-12 Cryptographic Key Establishment and Management Semi Annual/ Annual Annual/ Annual Annual/ Annual L L SC-13 Cryptographic Protection Semi Annual/ Annual Annual/ Annual Annual/ Annual L L SC-23 Session Authenticity Annual/ Annual Annual/ Annual Annual/ Annual L SC-28 Protection of Information at Rest Semi Annual/ Annual Annual/ Annual Annual/ Annual L L SC-38 Operations Security Annual/ Annual Annual/ Annual Annual/ Annual L L L SC-40 Wireless Link Protection Annual/ Annual Annual/ Annual Annual/ Annual SC-41 Port and I/O Device Access Semi Annual/ Annual Annual/ Annual Annual/ Annual SC-42 Sensor Capability and Data Semi Annual/ Annual Annual/ Annual Annual/ Annual SI-2 Flaw Remediation Monthly/ Annual Quarterly/ Annual Quarterly/ Annual L SI-4 Information System Monitoring Monthly/ Annual Quarterly/ Annual Quarterly/ Annual L L L SI-5 Security Alerts, Advisories, and Directives Monthly/ Annual Quarterly/ Annual Quarterly/ Annual L SI-6 Security Function Verification Annual/ Annual Annual/ Annual Annual/ Annual H SI-7 Software, Firmware, and Information Integrity Monthly/ Annual Quarterly/ Annual Quarterly/ Annual M
National Institute of Standards and Technology Special Publication 800-30 Rev. 1, Guide for Conducting Risk Assessments, September 2012 National Institute of Standards and Technology Special Publication 800-34, Rev. 1 Contingency Planning Guide for Federal Information Systems, May 2010 National Institute of Standards and Technology Special Publication 800-37, Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010 National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk, March 2011 National Institute of Standards and Technology Special Publication 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, April 2013 National Institute of Standards and Technology Special Publication 800-53A Rev. 4, Assessing Security and Privacy Controls in Federal Information System and Organizations, December 2014 National Institute of Standards and Technology Special Publication 800-64 Rev. 2, Security Considerations in the System Development Life-Cycle, October 2008 National Institute of Standards and Technology Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, September 2008 National Institute of Standards and Technology Special Publication 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011 National Institute of Standards and Technology Draft Special Publication 800-160, Systems Security Engineering, May 2014 Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004 DoDI 5000.02, Operation of the Defense Acquisition System, 7 January 2015 DoDI 5134.16, Deputy Assistant Secretary of Defense for Systems Engineering (DASD(SE)), 19 August 2011 DoDI 8500.1, Cybersecurity, 14 March 2014 DoDI 8510.01. Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014 DoDI 8551.1, Ports, Protocols, and Services Management (PPSM), 28 May 2014 DoDD 8000.1, Management of Defense Information Enterprise, 10 February 2009 CJCSI 3170.01I, Joint Capabilities Integration and Development System, 23 January 2015 CJCSM 6510.01F, Information Assurance (IA) and Computer Network Defense (CND), 9 February 2011