Navigate

CCI-000076

CCI-000076 Definition

Defines the frequency with which to review and update the organization-wide information security program plan.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

DoD has defined the frequency as reviewed annually - updated as appropriate.

Validation Procedures

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as reviewed annually - updated as appropriate.

Compelling Evidence

Automatically compliant per DoDI 8500.01.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000076.

Control	Description
PM-1	The organization: a: Develops and disseminates an organization-wide information security program plan that: 1: Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements; 2: Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance; 3: Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and 4: Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; b: Reviews the organization-wide information security program plan [organization-defined frequency]; c: Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and d: Protects the information security program plan from unauthorized disclosure and modification.

Control

Description

PM-1

The organization:

a: Develops and disseminates an organization-wide information security program plan that:
- 1: Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
- 2: Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
- 3: Reflects coordination among organizational entities responsible for the different aspects of information security (i.e., technical, physical, personnel, cyber-physical); and
- 4: Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

b: Reviews the organization-wide information security program plan [organization-defined frequency];

c: Updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and

d: Protects the information security program plan from unauthorized disclosure and modification.