CCI-001756

The organization defines the operational requirements on which the configuration settings for the organization-defined information system components are to be based.

Implementation Guidance

The organization being inspected/assessed must define and document in the system security plan, the requirements which may deviate from the approved configuration settings on the information system components defined in CM-6, CCI 1755. DoD has determined that it is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the system security plan to ensure the organization being inspected/assessed defines the requirements which may deviate from the approved configuration settings on the information system components defined in CM-6, CCI 1755. DoD has determined that it is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated system security plan (SSP)

The controls below (if any) were marked by NIST as being related to CCI-001756.