CCI-002194

Implementation Guidance

The organization being inspected/assessed defines and documents the metadata the information system uses to enforce information flow control. DoD has determined the metadata is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented metadata to ensure the organization being inspected/assessed defines the metadata the information system uses to enforce information flow control. DoD has determined the metadata is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated documentation that defines the metadata the system uses to enforce information flow.