CCI-001917

Implementation Guidance

The organization being inspected/assessed defines and documents the frequency for reviewing the open source information sites being monitored. DoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note: The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency for reviewing the open source information sites being monitored. DoD has determined that the frequency should be defined at the Component level, not appropriate to define at the Enterprise level. Note: The value in this control may not be used to deny reciprocal acceptance of a C&A (A&A) package.

Compelling Evidence

1.) Signed and dated audit and accountability policy 2.) Applicable STIG/SRG checks