CCI-000228

The organization implements a comprehensive strategy to manage risk to organization operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems consistently across the organization.

Implementation Guidance

DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy. DoD components are automatically compliant with this CCI because they are covered by the DoD Risk Management Framework (DoDI 8510.01).

Validation Procedures

DoD Risk Management Framework meets the requirement for a comprehensive organizational risk strategy. DoD components are automatically compliant with this CCI because they are covered by DoD Risk Management Framework (DoDI 8510.01).

Compelling Evidence

Automatically compliant per DoDI 8510.01.

The controls below (if any) were marked by NIST as being related to CCI-000228.