Navigate

CCI-000247

CCI-000247 Definition

The organization's security assessment plan describes assessment procedures to be used to determine security control effectiveness.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The implementation guidance and validation procedures posted on the Knowledge Service constitutes assessment procedures for DoD. If organizations being inspected/assessed use assessment procedures other than those posted on the Knowledge Service, those procedures must be documented. *Comment*The items required within this CCI are being split into the security plan and security assessment report to eliminate creation of an additional artifact.

Validation Procedures

DoD components are automatically compliant with this CCI if using the implementation guidance and validation procedures on the Knowledge Service. If the organization being inspected/assessed is using alternative implementation guidance and validation procedures, the organization conducting the inspection/assessment will obtain and examine those procedures.

Compelling Evidence

Automatically Compliant

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000247.

Control	Description
CA-2	The organization: CA-2a.: Develops a security assessment plan that describes the scope of the assessment including: CA-2a.1.: Security controls and control enhancements under assessment; CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities; CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; CA-2c.: Produces a security assessment report that documents the results of the assessment; and CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].

Control

Description

CA-2

The organization:

CA-2a.: Develops a security assessment plan that describes the scope of the assessment including:
- CA-2a.1.: Security controls and control enhancements under assessment;
- CA-2a.2.: Assessment procedures to be used to determine security control effectiveness; and
- CA-2a.3.: Assessment environment, assessment team, and assessment roles and responsibilities;

CA-2b.: Assesses the security controls in the information system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

CA-2c.: Produces a security assessment report that documents the results of the assessment; and

CA-2d.: Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles].