CCI-001787

The organization defines the acquired information system components that are to be assigned to an information system.

Implementation Guidance

The organization being inspected/assessed defines and documents the acquired information system components that are to be assigned to an information system. At no lower than the AO level, the organization must define and document the criteria for or types of information system components where assignment must be tracked. For example, all information system components that collect, store, or process information and are not themselves simply a storage media. DoD has determined that the acquired information system components are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documentation of acquired information system components to ensure the organization being inspected/assessed defines the acquired information system components that are to be assigned to an information system. DoD has determined that the acquired information system components are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Documentation that defines the acquired information system components that are to be assigned to an information system.

The controls below (if any) were marked by NIST as being related to CCI-001787.