Xylok Scanner CCIs

Number	Definition	Status	Related
CCI-004322	Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.	Draft	PM-4
CCI-004323	Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.	Draft	PM-4
CCI-004324	Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.	Draft	PM-4
CCI-004325	Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.	Draft	PM-4
CCI-004326	Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.	Draft	PM-4
CCI-004327	Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.	Draft	PM-4
CCI-004328	Develop an inventory of organizational systems.	Draft	PM-5
CCI-004329	Update, on an organization-defined frequency, an inventory of organizational systems.	Draft	PM-5
CCI-004330	Defines the frequency with which to update the inventory of organizational systems.	Draft	PM-5
CCI-004331	Establish an inventory of all systems, applications, and projects that process personally identifiable information.	Draft	PM-5(1)
CCI-004332	Maintain an inventory of all systems, applications, and projects that process personally identifiable information.	Draft	PM-5(1)
CCI-004333	Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.	Draft	PM-5(1)
CCI-004334	Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.	Draft	PM-5(1)
CCI-004335	Develop the results of information privacy measures of performance.	Draft	PM-6
CCI-004336	Monitor the results of information privacy measures of performance.	Draft	PM-6
CCI-004337	Report on the results of information privacy measures of performance.	Draft	PM-6
CCI-004338	Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft	PM-7
CCI-004339	Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft	PM-7
CCI-004340	Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft	PM-7
CCI-004341	Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.	Draft	PM-7(1)
CCI-004342	Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.	Draft	PM-7(1)
CCI-004343	Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.	Draft	PM-8
CCI-004344	Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.	Draft	PM-8
CCI-004345	Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.	Draft	PM-9
CCI-004346	Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.	Draft	PM-10
CCI-004347	Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.	Draft	PM-10
CCI-004348	Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft	PM-11
CCI-004349	Determine personally identifiable information processing needs arising from the defined mission and business processes.	Draft	PM-11
CCI-004350	Review and revise the mission and business processes on an organization-defined frequency.	Draft	PM-11
CCI-004351	Defines the frequency at which the mission and business processes are reviewed and revised.	Draft	PM-11

CCI-004322

Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.

Draft

PM-4

CCI-004323

Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.

Draft

PM-4

CCI-004324

Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.

Draft

PM-4