Navigate

CCI-000578

CCI-000578 Definition

Review and update the CONOPS in accordance with organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed reviews and updates the security CONOPS annually. The organization must maintain an audit trail of reviews and updates. DoD has defined the frequency as annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the security CONOPS annually. DoD has defined the frequency as annually.

Compelling Evidence

1.) Signed copy of concept of operations (CONOPS). 2.) Audit trail of reviews and updates to the concept of operations (CONOPS).

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000578.

Control	Description
PL-7	The organization: a: Develops a security Concept of Operations (CONOPS) for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security; and b: Reviews and updates the CONOPS [organization-defined frequency].