Xylok Scanner CCIs

Number	Definition	Status
CCI-004322	Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.	Draft
CCI-004323	Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.	Draft
CCI-004324	Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.	Draft
CCI-004325	Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.	Draft
CCI-004326	Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.	Draft
CCI-004327	Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.	Draft
CCI-004328	Develop an inventory of organizational systems.	Draft
CCI-004329	Update, on an organization-defined frequency, an inventory of organizational systems.	Draft
CCI-004330	Defines the frequency with which to update the inventory of organizational systems.	Draft
CCI-004331	Establish an inventory of all systems, applications, and projects that process personally identifiable information.	Draft
CCI-004332	Maintain an inventory of all systems, applications, and projects that process personally identifiable information.	Draft
CCI-004333	Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.	Draft
CCI-004334	Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.	Draft
CCI-004335	Develop the results of information privacy measures of performance.	Draft
CCI-004336	Monitor the results of information privacy measures of performance.	Draft
CCI-004337	Report on the results of information privacy measures of performance.	Draft
CCI-004338	Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft
CCI-004339	Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft
CCI-004340	Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft
CCI-004341	Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.	Draft
CCI-004342	Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.	Draft
CCI-004343	Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.	Draft
CCI-004344	Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.	Draft
CCI-004345	Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.	Draft
CCI-004346	Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.	Draft
CCI-004347	Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.	Draft
CCI-004348	Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.	Draft
CCI-004349	Determine personally identifiable information processing needs arising from the defined mission and business processes.	Draft
CCI-004350	Review and revise the mission and business processes on an organization-defined frequency.	Draft
CCI-004351	Defines the frequency at which the mission and business processes are reviewed and revised.	Draft

CCI-004322

Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.

Draft

CCI-004323

Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.

Draft

CCI-004324

Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.

Draft

CCI-004325

Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.

Draft