CCI-002738

The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.

Implementation Guidance

The organization being inspected/assessed documents and provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented exceptions to the source code requirement to ensure the organization being inspected/assessed provides justification and approval of the authorizing official for all exceptions to the source code requirement.

Compelling Evidence

1.) Signed and dated System security plan documents and provides expectations to he source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official.

The controls below (if any) were marked by NIST as being related to CCI-002738.