GRR-5—CSO Personnel
IL4 Mod
IL4 High
IL5
IL6
>Control Description
(a) Does the CSP establish position sensitivity risk determinations based on OPM guidance and the Position Sensitivity Tool?
(b) How does the CSP restrict potential access to DoD information to U.S. Citizens?
(c) Are all CSO roles with access to DoD CUI categorized as critical sensitive been subject to a satisfactory Single Scope Background Investigation or other background investigation for high risk?
(d) Are other CSO roles categorized as moderate risk position designations with access to non-critical sensitive information subject to a satisfactory moderate risk background investigation or a National Agency Check with Law and Credit ?
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
See Section 5.6.2, and all subsections, of CC SRG V1R4 for additional details.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What documented policies and procedures address cso personnel?
- •Who is accountable for implementing and maintaining cso personnel controls?
- •How frequently are cso personnel requirements reviewed, and what triggers updates?
- •What process ensures changes to systems maintain compliance with cso personnel requirements?
- •How are exceptions to cso personnel requirements documented and approved?
Technical Implementation:
- •What technical controls enforce cso personnel in your environment?
- •How are cso personnel controls configured and maintained across all systems?
- •What automated mechanisms support cso personnel compliance?
- •How do you validate that cso personnel implementations achieve their intended security outcome?
- •What compensating controls exist if primary cso personnel controls cannot be fully implemented?
Evidence & Documentation:
- •What documentation proves cso personnel is implemented and operating effectively?
- •Can you provide configuration evidence showing how cso personnel is technically enforced?
- •What audit logs or monitoring data demonstrate ongoing cso personnel compliance?
- •Can you show evidence of a recent review or assessment of cso personnel controls?
- •What artifacts would you provide during an assessment to demonstrate cso personnel compliance?
Ask AI
Configure your API key to use AI features.