Navigate

CCI-001050

CCI-001050 Definition

Review risk assessment results on an organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed reviews risk assessment results upon re-accreditation. The organization must maintain a record of reviews. DoD has defined the frequency as upon re-accreditation.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the record of reviews to ensure the organization being inspected/assessed reviews risk assessment results upon re-accreditation. DoD has defined the frequency as upon re-accreditation.

Compelling Evidence

1.) System security plan (SSP). 2.) Reference to system security plan (SSP) section pertaining to vulnerability scanning procedure. Reference section pertaining to Risk Assessment Implementation.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001050.

Control	Description
RA-3	The organization: a: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits; b: Documents risk assessment results in []; c: Reviews risk assessment results [organization-defined frequency]; d: Disseminates risk assessment results to [organization-defined personnel or roles]; and e: Updates the risk assessment [organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

Control

Description

RA-3

The organization:

a: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits;

b: Documents risk assessment results in [];

c: Reviews risk assessment results [organization-defined frequency];

d: Disseminates risk assessment results to [organization-defined personnel or roles]; and

e: Updates the risk assessment [organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.