CCI-000363

The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.

Implementation Guidance

DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc). The organization being inspected/assessed documents in the security plan, the configuration guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc) which apply to their information system components.

Validation Procedures

DoD has defined the security configuration checklists as DoD security configuration or implementation guidance (e.g. STIGs, SRGs, NSA configuration guides, CTOs, DTMs etc). The organization conducting the inspection/assessment obtains and examines the security plan to ensure the organization being inspected/assessed has documented the configuration guidance which apply to their information system components. The organization conducting the inspection/assessment reviews the list of documented guidance to ensure that all applicable guidance is identified given the information system components within the authorization boundary.

Compelling Evidence

1.) Signed and dated security configuration checklist

The controls below (if any) were marked by NIST as being related to CCI-000363.