Navigate

CCI-000119

CCI-000119 Definition

The organization reviews and updates the audit and accountability policy on an organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed reviews and updates the audit and accountability policy annually. The organization must maintain an audit trail of reviews and updates. Any changes or acceptance of the document without change must be captured in the audit trail. DoD has defined the frequency as annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the audit and accountability policy annually. DoD has defined the frequency as annually.

Compelling Evidence

1.) Signed and dated audit and accountability policy version update page

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000119.

Control	Description
AU-1	The organization: AU-1a.: Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]: AU-1a.1.: An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and AU-1a.2.: Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and AU-1b.: Reviews and updates the current: AU-1b.1.: Audit and accountability policy [Assignment: organization-defined frequency]; and AU-1b.2.: Audit and accountability procedures [Assignment: organization-defined frequency].

Control

Description

AU-1

The organization:

AU-1a.: Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
- AU-1a.1.: An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- AU-1a.2.: Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and

AU-1b.: Reviews and updates the current:
- AU-1b.1.: Audit and accountability policy [Assignment: organization-defined frequency]; and
- AU-1b.2.: Audit and accountability procedures [Assignment: organization-defined frequency].