CCI-003383

Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service.

Implementation Guidance

The organization being inspected/assessed defines and documents the official government duties to be assigned to the developer of organization-defined information system, system component, or information system service. DoD has determined the official government duties are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented official government duties to ensure the organization being inspected/assessed defines the official government duties to be assigned to the developer of organization-defined information system, system component, or information system service. DoD has determined the official government duties are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan that defines the official government duties to be assigned to the developers of organization-defined information system, system component, or information system service.

The controls below (if any) were marked by NIST as being related to CCI-003383.