Risk Assessment (RA)
Level 3
Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.
Security Assessment (CA)
Level 2
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Security Assessment (CA)
Level 2
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
Security Assessment (CA)
Level 2
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Security Assessment (CA)
Level 2
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
Security Assessment (CA)
Level 3
Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts.
System and Communications Protection (SC)
Level 1
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
System and Communications Protection (SC)
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
System and Communications Protection (SC)
Level 2
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
System and Communications Protection (SC)
Level 2
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
