CCI-000348

The organization defines a frequency with which to conduct reviews of information system changes.

Implementation Guidance

DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.

Validation Procedures

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems.

Compelling Evidence

Automatically Compliant

The controls below (if any) were marked by NIST as being related to CCI-000348.