Establishes requirements for periodically assessing security controls and monitoring organizational systems — covering 4 controls per NIST SP 800-171 Rev 2.
OCSI shall periodically assess security controls in organizational systems to determine if controls are effective in their application, develop and implement plans of action to correct deficiencies, and monitor security controls on an ongoing basis. external MSSP provides independent assessment services aligned with their 5-phase cybersecurity methodology.
| Control | Requirement | Implementation | Status |
|---|---|---|---|
| 3.12.1 | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application | NOT IMPLEMENTED. No formal security control assessment has been conducted. No external MSSP or C3PAO has been engaged. This self-assessment (AI-assisted) is the only review performed to date. A formal assessment methodology must be established. | Not Implemented |
| 3.12.2 | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems | PARTIAL. POA&M document exists (POA&M) with 13 open items identified during this honest review. However, this is the first formal gap analysis — no prior deficiency tracking existed. POA&M process needs formalization with assigned owners, timelines, and regular review cadence. | Partial |
| 3.12.3 | Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls | NOT IMPLEMENTED. No continuous monitoring program exists. Audit logs exist in localStorage but are not reviewed on any schedule. No external MSSP monitoring. No automated alerting. Security headers are set but not verified on a recurring basis. | Not Implemented |
| 3.12.4 | Develop, document, and periodically update system security plans | PARTIAL. System Security Plan (SSP) exists and has been updated with honest control statuses. However, no formal review cadence is established and no prior SSP versions exist. SSP needs a defined update schedule and version tracking. | Partial |
| Phase | Activity | Frequency | Output |
|---|---|---|---|
| 1. Assessment | Evaluate 110 NIST 800-171 controls | Annually (comprehensive), Quarterly (targeted) | Assessment report |
| 2. Remediation | Address identified gaps | Per findings timeline | Updated POA&M |
| 3. Testing | Verify control effectiveness | Post-remediation | Test results |
| 4. Monitoring | Ongoing surveillance | Continuous | Monitoring reports |
| 5. Incident Response | IR capability validation | Annual tabletop + as needed | Exercise results |