CCI-001227

Implementation Guidance

The organization being inspected/assessed corrects information system flaws within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs). The organization documents the corrections on their POA&M. DoD has defined the time period as within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the information system POA&M and examines the information system to ensure the organization being inspected/assessed corrects information system flaws.

Compelling Evidence

1.) Signed and dated System security plan (SSP) with a reference to the section that pertains to how system flaws are fixed or mitigated.