Attachment_0014_SCTM_for_RFP_reference.xlsx
XLSX spreadsheet 228 KB Posted
- Attached to
- DCGS-A Capability Drop-1 Synopsis
- Solicitation number
- W56KGY-17-R-0026
About this file
Security Controls Assessment Procedures
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SecurityControls
CNSS 1253 Security Controls Assessment Procedures Confidentiality: Moderate; Integrity: Moderate; Availability: Moderate Overlays Applied: Classified Systems with applicable Intel Overlay controls
| Control Number | 800-53 Control Text Indicator | CCI | CCI Definition | Implementation Guidance | Assessment Procedures |
| IA-1 | IA-1 (a) (1) | CCI-001932 | The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | DoD documents within DoDI 8520.02 and DoDI 8520.03 an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. |
| DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03. | DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03. | |||||
| IA-1 | IA-1 (a) | CCI-001934 | The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. | DoD documents within DoDI 8520.02 and DoDI 8520.03 procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. |
| DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03. | DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 8520.02 and DoDI 8520.03. | ||||||
| AC-1 | AC-1 (a) | CCI-002107 | The organization defines the personnel or roles to be recipients of the access control policy necessary to facilitate the implementation of the access control policy and associated access controls. | DoD has defined the personnel or roles as all personnel. | The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. |
DoD has defined the personnel or roles as all personnel.
AC-1 AC-1 (a) CCI-002108 The organization defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the access control policy and associated access controls. DoD has defined the personnel or roles as all personnel. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the personnel or roles as all personnel.
| AC-1 | AC-1 (a) (1) | CCI-000001 | The organization develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | The organization being inspected/assessed develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | The organization conducting the inspection/assessment obtains and examines the access control policy to ensure the organization being inspected/assessed develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. |
| AC-1 | AC-1 (a) (1) | CCI-000002 | The organization disseminates the access control policy to organization-defined personnel or roles. | The organization being inspected/assessed disseminates via an information sharing capability to all personnel. |
DoD has defined the personnel or roles as all personnel. The organization conducting the inspection/assessment examines the access control policy via the organization's information sharing capability to ensure the organization being inspected/assessed disseminates the policy to all personnel.
DoD has defined the personnel or roles as all personnel.
| AC-1 | AC-1 (a) (2) | CCI-000004 | The organization develops and documents procedures to facilitate the implementation of the access control policy and associated access controls. | The organization being inspected/assessed develops and documents procedures to facilitate the implementation of the access control policy and associated access controls. | The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the access control policy and associated access controls to ensure the organization being inspected/assessed develops and documents procedures to facilitate the implementation of the access control policy and associated access controls. |
| AC-1 | AC-1 (a) (2) | CCI-000005 | The organization disseminates the procedures to facilitate access control policy and associated access controls to the organization-defined personnel or roles . | The organization being inspected/assessed disseminates via an information sharing capability to all personnel the procedures to facilitate access control policy and associated access controls. |
DoD has defined the personnel or roles as all personnel. The organization conducting the inspection/assessment examines the procedures to facilitate access control policy and associated access controls via the organization's information sharing capability to ensure the organization being inspected/assessed disseminates the procedures to all personnel.
DoD has defined the personnel or roles as all personnel.
AC-1 AC-1 (b) (1) CCI-001545 The organization defines a frequency for reviewing and updating the access control policy. DoD has defined the frequency as annually. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the frequency as annually.
AC-1 AC-1 (b) (1) CCI-000003 The organization reviews and updates the access control policy in accordance with organization-defined frequency. The organization being inspected/assessed annually reviews and updates the access control policy.
The organization must maintain review and update activity as an audit trail.
DoD has defined the frequency as annually. The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed annually reviews and updates the access control policy.
DoD has defined the frequency as annually.
AC-1 AC-1 (b) (2) CCI-001546 The organization defines a frequency for reviewing and updating the access control procedures. DoD has defined the frequency as annually. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the frequency as annually.
AC-1 AC-1 (b) (2) CCI-000006 The organization reviews and updates the access control procedures in accordance with organization-defined frequency. The organization being inspected/assessed annually reviews and updates the access control procedures.
The organization must maintain review and update activity as an audit trail.
DoD has defined the frequency as annually. The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed annually reviews and updates the access control procedures.
DoD has defined the frequency as annually.
AC-2 AC-2 (a) CCI-002110 The organization defines the information system account types that support the organizational missions/business functions. The organization being inspected/assessed defines and documents the information system account types that support the organizational missions/business functions.
DoD has determined the information system account types are not appropriate to define at the Enterprise level. The organization conducting the inspection/assessment obtains and examines the documented information system account types to ensure the organization being inspected/assessed defines the information system account types that support the organizational missions/business functions.
DoD has determined the information system account types are not appropriate to define at the Enterprise level.
| AC-2 | AC-2 (a) | CCI-002111 | The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions. | The account types are defined per AC-2, CCI 2110. | The account types are defined per AC-2, CCI 2110. |
| AC-2 | AC-2 (b) | CCI-002112 | The organization assigns account managers for information system accounts. | The organization being inspected/assessed documents personnel responsible for the management of system accounts. | The organization conducting the inspection/assessment obtains and examines the documented appointment of management personnel to ensure that the organization being inspected/assessed has documented personnel responsible for the management of system accounts. |
| AC-2 | AC-2 (c ) | CCI-000008 | The organization establishes conditions for group membership. | The organization being inspected/assessed documents conditions for adding accounts as members of groups. | The organization conducting the inspection/assessment obtains and examines the documented conditions for adding accounts as members of groups to ensure that the conditions are established. |
| AC-2 | AC-2 (c ) | CCI-002113 | The organization establishes conditions for role membership. | The organization being inspected/assessed documents conditions for adding accounts as members of roles. | The organization conducting the inspection/assessment obtains and examines the documented conditions for adding accounts as members of roles to ensure that the conditions are established. |
| AC-2 | AC-2 (d) | CCI-002115 | The organization specifies authorized users of the information system. | The organization being inspected/assessed documents authorized users of the information system. | The organization conducting the inspection/assessment obtains and examines the documented list of authorized users for a sampling of information system accounts to ensure that the authorized users are specified. |
| AC-2 | AC-2 (d) | CCI-002116 | The organization specifies authorized group membership on the information system. | The organization being inspected/assessed documents authorized group membership on the information system. | The organization conducting the inspection/assessment obtains and examines the documented list of authorized groups for a sampling of information system accounts to ensure that the authorized groups are specified. |
| AC-2 | AC-2 (d) | CCI-002117 | The organization specifies authorized role membership on the information system. | The organization being inspected/assessed documents authorized role membership on the information system. | The organization conducting the inspection/assessment obtains and examines the documented list of authorized roles for a sampling of information system accounts to ensure that the authorized roles are specified |
| AC-2 | AC-2 (d) | CCI-002118 | The organization specifies access authorizations (i.e., privileges) for each account on the information system. | The organization being inspected/assessed documents access authorizations (i.e., privileges) for each account on the information system. | The organization conducting the inspection/assessment obtains and examines the documented list of access authorizations for a sampling of information system accounts to ensure that the access authorizations are specified. |
| AC-2 | AC-2 (d) | CCI-002119 | The organization specifies other attributes for each account on the information system. | The organization being inspected/assessed documents other attributes for each account on the information system. | The organization conducting the inspection/assessment obtains and examines the documented list of other attributes for a sampling of information system accounts to ensure that other attributes are specified. |
| AC-2 | AC-2 (e ) | CCI-002120 | The organization defines the personnel or roles authorized to approve the creation of information system accounts. | DoD has defined the personnel or roles as the ISSM or ISSO. | The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. |
DoD has defined the personnel or roles as the ISSM or ISSO.
AC-2 AC-2 (e ) CCI-000010 The organization requires approvals by organization-defined personnel or roles for requests to create information system accounts. The organization being inspected/assessed implements a process for the ISSM or ISSO to approve information system account requests.
The organization being inspected/assessed maintains an audit trail of approvals.
DoD has defined the personnel or roles as the ISSM or ISSO. The organization conducting the inspection/assessment obtains and examines the audit trail of approvals to ensure that the organization being inspected/assessed implements a process for the ISSM or ISSO to approve information system account requests.
DoD has defined the personnel or roles as the ISSM or ISSO.
AC-2 AC-2 (f) CCI-002121 The organization defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts. The organization being inspected/assessed defines and documents the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level. The organization conducting the inspection/assessment obtains and examines the documented procedures or conditions to ensure the organization being inspected/assessed defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts.
DoD has determined the procedures or conditions are not appropriate to define at the Enterprise level.
AC-2 AC-2 (f) CCI-000011 The organization creates, enables, modifies, disables, and removes information system accounts in accordance with organization-defined procedures or conditions. The organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, and remove information system accounts in accordance with procedures or conditions defined in AC-2, 2121.
| The organization being inspected/assessed maintains an audit trail of account maintenance activities. | The organization conducting the inspection/assessment obtains and examines the audit trail of account maintenance activities to ensure the organization being inspected/assessed implements account maintenance processes to create, enable, modify, disable, remove, and track information system accounts in accordance with procedures or conditions defined in AC-2, 2121. | ||||||
| AC-2 | AC-2 (g) | CCI-002122 | The organization monitors the use of information system accounts. | The organization being inspected/assessed implements a process to monitor the use of information system accounts. | The organization conducting the inspection/assessment obtains and examines the audit trail to ensure that the organization being inspected/assessed implements a process to monitor the use of information system accounts. | ||
| AC-2 | AC-2 (h) (1) | CCI-002123 | The organization notifies account managers when accounts are no longer required. | The organization being inspected/assessed implements a process to notify account managers when accounts are no longer required. |
| The organization being inspected/assessed maintains an audit trail of notifications. | The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when accounts are no longer required. | |||||
| AC-2 | AC-2 (h) (2) | CCI-002124 | The organization notifies account managers when users are terminated or transferred. | The organization being inspected/assessed implements a process to notify account managers when users are terminated or transferred. |
| The organization being inspected/assessed maintains an audit trail of notifications. | The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when users are terminated or transferred. | |||||
| AC-2 | AC-2 (h) (3) | CCI-002125 | The organization notifies account managers when individual information system usage or need-to-know changes. | The organization being inspected/assessed implements a process to notify account managers when individual information system usage or need-to-know changes. |
| The organization being inspected/assessed maintains an audit trail of notifications. | The organization conducting the inspection/assessment obtains and examines the audit trail of notifications to ensure the organization being inspected/assessed implements a process to notify account managers when individual information system usage or need-to-know changes. | |||||
| AC-2 | AC-2 (i) (1) | CCI-002126 | The organization authorizes access to the information system based on a valid access authorization. | The organization being inspected/assessed authorizes access to the information system based on the access authorization process. |
| The organization being inspected/assessed maintains an audit trail of approved access. | The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on the access authorization process. | |||||
| AC-2 | AC-2 (i) (2) | CCI-002127 | The organization authorizes access to the information system based on intended system usage. | The organization being inspected/assessed authorizes access to the information system based on intended system usage. |
| The organization being inspected/assessed maintains an audit trail of approved access. | The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on intended system usage. | |||||
| AC-2 | AC-2 (i) (3) | CCI-002128 | The organization authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions. | The organization being inspected/assessed authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions. |
| The organization being inspected/assessed maintains an audit trail of approved access. | The organization conducting the inspection/assessment obtains and examines the audit trail of approved access to ensure the organization being inspected/assessed authorizes access to the information system based on other attributes as required by the organization or associated missions/business functions. | |||||
| AC-2 | AC-2 (j) | CCI-000012 | The organization reviews information system accounts for compliance with account management requirements per organization-defined frequency. | The organization being inspected/assessed implements a process to review information system accounts for compliance with account management requirements at a minimum, annually. |
The organization being inspected/assessed maintains an audit trail of reviews.
DoD has defined the frequency as at a minimum, annually. The organization conducting the inspection/assessment obtains and examines the audit trail of reviews to ensure the organization being inspected/assessed implements a process to review information system accounts for compliance with account management requirements at a minimum, annually.
DoD has defined the frequency as at a minimum, annually.
AC-2 AC-2 (j) CCI-001547 The organization defines the frequency on which it will review information system accounts for compliance with account management requirements. DoD has defined the frequency as at a minimum, annually. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the frequency as at a minimum, annually.
| AC-2 | AC-2 (k) | CCI-002129 | The organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | The organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. | The organization conducting the inspection/assessment obtains and examines the account management procedures to ensure the organization being inspected/assessed includes in the account management procedures a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. |
| AC-2 (1) | AC-2 (1) | CCI-000015 | The organization employs automated mechanisms to support the information system account management functions. | The organization being inspected/assessed configures the information system to employ automated mechanisms to support the information system account management functions. |
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000015. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ automated mechanisms to support the information system account management functions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000015.
AC-2 (2) AC-2 (2) CCI-000016 The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account. The organization being inspected/assessed configures the information system to automatically remove or disable temporary accounts after 72 hours.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000016.
DoD has defined the time period as 72 hours. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically remove or disable temporary accounts after 72 hours.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000016.
DoD has defined the time period as 72 hours.
AC-2 (2) AC-2 (2) CCI-001361 The organization defines a time period after which temporary accounts are automatically terminated. DoD has defined the time period as 72 hours.
The time period of 72 hours applies to temporary user accounts. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the time period as 72 hours.
The time period of 72 hours applies to temporary user accounts.
AC-2 (2) AC-2 (2) CCI-001365 The organization defines a time period after which emergency accounts are automatically terminated. DoD has defined the time period as never.
The time period of never applies to emergency admin accounts. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the time period as never.
The time period of never applies to emergency admin accounts.
AC-2 (2) AC-2 (2) CCI-001682 The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account. The organization being inspected/assessed configures the information system to never automatically remove or disable emergency accounts.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1682.
DoD has defined the time period as never.
The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to never automatically remove or disable emergency accounts.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1682.
DoD has defined the time period as never.
AC-2 (3) AC-2 (3) CCI-000017 The information system automatically disables inactive accounts after an organization-defined time period. The organization being inspected/assessed configures the information system to disable inactive accounts after 35 days.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 000017.
DoD has defined the time period as 35 days. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to disable inactive accounts after 35 days.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 000017.
DoD has defined the time period as 35 days.
AC-2 (3) AC-2 (3) CCI-000217 The organization defines a time period after which inactive accounts are automatically disabled. DoD has defined the time period as 35 days. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the time period as 35 days.
AC-2 (4) AC-2 (4) CCI-000018 The information system automatically audits account creation actions. The organization being inspected/assessed configures the information system to automatically audit account creation actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 18. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account creation actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 18.
AC-2 (4) AC-2 (4) CCI-001403 The information system automatically audits account modification actions. The organization being inspected/assessed configures the information system to automatically audit account modification actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1403. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account modification actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1403.
AC-2 (4) AC-2 (4) CCI-002130 The information system automatically audits account enabling actions. The organization being inspected/assessed configures the information system to automatically audit account enabling actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2130. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account enabling actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2130.
AC-2 (4) AC-2 (4) CCI-001404 The information system automatically audits account disabling actions. The organization being inspected/assessed configures the information system to automatically audit account disabling actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1404. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account disabling actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1404.
AC-2 (4) AC-2 (4) CCI-001405 The information system automatically audits account removal actions. The organization being inspected/assessed configures the information system to automatically audit account removal actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1405. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to automatically audit account removal actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1405.
AC-2 (4) AC-2 (4) CCI-001683 The information system notifies organization-defined personnel or roles for account creation actions. The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account creation actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1683.
DoD has defined the personnel or roles as the system administrator and ISSO. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account creation actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1683.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (4) AC-2 (4) CCI-001684 The information system notifies organization-defined personnel or roles for account modification actions. The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account modification actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1684.
DoD has defined the personnel or roles as the system administrator and ISSO. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account modification actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1684.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (4) AC-2 (4) CCI-002132 The information system notifies organization-defined personnel or roles for account enabling actions. The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account enabling actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2132.
DoD has defined the personnel or roles as the system administrator and ISSO. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account enabling actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2132.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (4) AC-2 (4) CCI-001685 The information system notifies organization-defined personnel or roles for account disabling actions. The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account disabling actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1685.
DoD has defined the personnel or roles as the system administrator and ISSO. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account disabling actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1685.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (4) AC-2 (4) CCI-001686 The information system notifies organization-defined personnel or roles for account removal actions. The organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account removal actions.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1686.
DoD has defined the personnel or roles as the system administrator and ISSO. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to notify the system administrator and ISSO for account removal actions.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1686.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (4) AC-2 (4) CCI-002131 The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions. DoD has defined the personnel or roles as the system administrator and ISSO. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the personnel or roles as the system administrator and ISSO.
AC-2 (5) AC-2 (5) CCI-002133 The organization defines other conditions when users are required to log out. The organization being inspected/assessed defines and documents the other conditions when users are required to log out.
DoD has determined the conditions are not appropriate to define at the Enterprise level. The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure they have been defined.
DoD has determined the conditions are not appropriate to define at the Enterprise level.
AC-2 (5) AC-2 (5) (a) CCI-000019 The organization requires that users log out in accordance with the organization-defined time period of inactivity and/or description of when to log out. The organization being inspected/assessed documents in the user policies that users are required to log out at the end of the users standard work period unless otherwise defined in formal organizational policy and IAW conditions defined in AC-2 (5) CCI 2133.
DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy. The organization conducting the inspection/assessment obtains and examines the user policies to ensure that users are required to log out at the end of the users standard work period unless otherwise defined in formal organizational policy and IAW conditions defined in AC-2 (5) CCI 2133.
DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.
AC-2 (5) AC-2 (5) (a) CCI-001406 The organization defines a time period of expected inactivity when users are required to log out. DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy. The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.
DoD has defined the time period as at the end of the users standard work period unless otherwise defined in formal organizational policy.
| AC-2 (7) | AC-2 (7) (a) | CCI-001358 | The organization establishes privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. | The organization being inspected/assessed documents and implements a process to establish privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. | The organization conducting the inspection/assessment obtains and examines documented processes for privileged user account creation to ensure the organization being inspected/assessed establishes privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. |
| AC-2 (7) | AC-2 (7) (a) | CCI-001407 | The organization administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. | The organization being inspected/assessed documents and implements a process to administer privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. | The organization conducting the inspection/assessment obtains and examines documented processes for privileged user account creation to ensure the organization being inspected/assessed administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles. |
| AC-2 (7) | AC-2 (7) (b) | CCI-001360 | The organization monitors privileged role assignments. | The organization being inspected/assessed implements a process to monitor privileged role assignments. |
| The organization must maintain an audit trail of monitoring. | The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring to ensure the organization being inspected/assessed monitors privileged role assignments. | ||||||
| AC-2 (7) | AC-2 (7) (c ) | CCI-002136 | The organization defines the actions to be taken when privileged role assignments are no longer appropriate | DoD has defined the actions as disables (or revokes) privileged user account. | The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. |
DoD has defined the actions as disables (or revokes) privileged user account.
AC-2 (7) AC-2 (7) (c ) CCI-002137 The organization takes organization-defined actions when privileged role assignments are no longer appropriate. The organization being inspected/assessed documents and implements a process to disable (or revoke) the privileged user account when privileged role assignments are no longer appropriate.
The organization must maintain an audit trail of the actions taken.
DoD has defined the actions as disables (or revokes) privileged user account. The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of actions taken to ensure the organization being inspected/assessed disables (or revokes) the privileged user account when privileged role assignments are no longer appropriate.
DoD has defined the actions as disables (or revokes) privileged user account.
AC-2 (9) AC-2 (9) CCI-002140 The organization defines the conditions for establishing shared/group accounts. The organization being inspected/assessed defines and documents the conditions for establishing shared/group accounts.
DoD has determined the conditions are not appropriate to define at the Enterprise level. The organization conducting the inspection/assessment obtains and examines the documented conditions to ensure they have been defined.
DoD has determined the conditions are not appropriate to define at the Enterprise level.
| AC-2 (9) | AC-2 (9) | CCI-002141 | The organization only permits the use of shared/group accounts that meet organization-defined conditions for establishing shared/group accounts. | The organization being inspected/assessed only permits the use of shared/group accounts that meet the conditions for establishing shared/group accounts defined in AC-2 (9), CCI 2140. | The organization conducting the inspection/assessment examines the shared/group accounts to ensure the organization being inspected/assessed only permits the use of shared/group accounts that meet the conditions for establishing shared/group accounts defined in AC-2 (9), CCI 2140. |
| AC-2 (10) | AC-2 (10) | CCI-002142 | The information system terminates shared/group account credentials when members leave the group. | The organization being inspected/assessed configures the information system to terminate shared/group account credentials when members leave the group. |
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 2142. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to terminate shared/group account credentials when members leave the group.
For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2142.
AC-2 (12) AC-2 (12) (a) CCI-002146 The organization defines atypical usage for which the information system accounts are to be monitored. The organization being inspected/assessed defines and documents atypical usage for which the information system accounts are to be monitored.
DoD has determined atypical usage is not appropriate to define at the Enterprise level. The organization conducting the inspection/assessment obtains and examines the documented atypical usage to ensure it has been defined.
DoD has determined atypical usage is not appropriate to define at the Enterprise level.
AC-2 (12) AC-2 (12) (a) CCI-002147 The organization monitors information system accounts for organization-defined atypical use. The organization being inspected/assessed monitors information system accounts for atypical use defined in AC-2 (12), CCI 2146.
| The organization must maintain an audit trail of monitoring. | The organization conducting the inspection/assessment obtains and examines the audit trail of monitoring to ensure the organization being inspected/assessed monitors information system accounts for atypical use defined in AC-2 (12), CCI 2146. | ||||||
| AC-2 (12) | AC-2 (12) (b) | CCI-002148 | The organization defines the personnel or roles to whom atypical usage of information system accounts are to be reported. | DoD has defined the personnel or roles as at a minimum, the ISSO. | The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. |
DoD has defined the personnel or roles as at a minimum, the ISSO.
AC-2 (12) AC-2 (12) (b) CCI-002149 The organization reports atypical usage of information system accounts to organization-defined personnel or roles. The organization being inspected/assessed documents and implements a process to report atypical usage defined in AC-2 (12), CCI 2146 of information system accounts to at a minium, the ISSO.
The organization must maintain an audit trail of reporting.
DoD has defined the personnel or roles as at a minimum, the ISSO. The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reporting to ensure the organization being inspected/assessed reports atypical usage defined in AC-2 (12), CCI 2146 of information system accounts to at a minimum, the ISSO.
DoD has defined the personnel or roles as at a minimum, the ISSO.
| AC-2 (13) | AC-2 (13) | CCI-002150 | The organization defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk. | DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy. | |
| The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. |
DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.
AC-2 (13) AC-2 (13) CCI-002151 The organization disables accounts of users posing a significant risk within organization-defined time period of discovery of the risk. The organization being inspected/assessed documents and implements a process to disable accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy.
DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.
The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disables accounts of users posing a significant risk within 30 minutes unless otherwise defined in formal organizational policy.
DoD has defined the time period as 30 minutes unless otherwise defined in formal organizational policy.
AC-3 AC-3 CCI-000213 The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. The organization being inspected/assessed configures the information system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 213. The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
For information system components that…
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .