The organization includes as part of security control assessments, [Assignment: organization- defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: organization-defined other forms of security assessment]].
annually
Not appropriate for DoD to define for all CSP's infrastructure or service offerings
Not appropriate for DoD to define for all CSP's infrastructure or service offerings
Not appropriate for DoD to define for all CSP's infrastructure or service offerings
Source:
DoD RMF TAG
Organizations can employ information system monitoring, insider threat assessments, malicious user testing, and other forms of testing (e.g., verification and validation) to improve readiness by exercising organizational capabilities and indicating current performance levels as a means of focusing actions to improve security. Organizations conduct assessment activities in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. Authorizing officials approve the assessment methods in coordination with the organizational risk executive function. Organizations can incorporate vulnerabilities uncovered during assessments into vulnerability remediation processes.
CA-2 (2) Requirement: To include 'announced', 'vulnerability scanning'