The organization develops a security assessment plan for the information system and its environment of operation.
No STIG checks reference this CCI.