Failure to ensure that the backup media is shipped using an accountable delivery service [Test: Media Transport (e.g. U.S. Postal Service First [Test: - Backup [E-# OR [NIST 800-53 w/ Class Mail, Federal Express, - Backup High Media Shipping] W-#] DHS 4300A MP-5 United Parcel Service) and Media Shipping] (DHS-4.11.f)] properly inventoried could lead Not Entered to the compromise of the Not Entered system or of the data in the system. Failure to meet the auditable events requirements listed below could cause difficulty in the general auditing protocols implemented to suit security polices being followed: [Test: AU-2(3).1 - (i) the organization defines the Auditable Events [Test: AU-2(3).1 - Reviews And [E-# OR frequency of reviews and [NIST 800-53 w/ Reviews And High Updates] W-#] updates to the list of DHS AU-2 (3)] Updates] organization-defined auditable Not Entered events; and, Not Entered (ii) the organization reviews and updates the list of organization-defined auditable events in accordance with the organization-defined frequency. Failure of the organization to Malicious Code [Test: SI-3(1).1 - centrally manage malicious [E-# OR Protection [NIST Central Management] code protection mechanisms High W-#] 800-53 w/ DHS [Test: SI-3(1).1 - could result in the inability to 4300A SI-3 (1)] Central Management] Not Entered detect threats/vulnerabilities
[E-# OR W-#] Media Transport [NIST 800-53 w/ DHS 4300A MP-5 (DHS-4.11.f)] [Test: - Backup Media Shipping] Not Entered Failure to ensure that the backup media is shipped using an accountable delivery service (e.g. U.S. Postal Service First Class Mail, Federal Express, United Parcel Service) and properly inventoried could lead to the compromise of the system or of the data in the system. High [Test: - Backup Media Shipping] Not Entered [E-# OR W-#] Auditable Events [NIST 800-53 w/ DHS AU-2 (3)] [Test: AU-2(3).1 - Reviews And Updates] Not Entered Failure to meet the auditable events requirements listed below could cause difficulty in the general auditing protocols implemented to suit security polices being followed: (i) the organization defines the frequency of reviews and updates to the list of organization-defined auditable events; and, (ii) the organization reviews and updates the list of organization-defined auditable events in accordance with the organization-defined frequency. High [Test: AU-2(3).1 - Reviews And Updates] Not Entered [E-# OR W-#] Malicious Code Protection [NIST 800-53 w/ DHS 4300A SI-3 (1)] [Test: SI-3(1).1 - Central Management] Failure of the organization to centrally manage malicious code protection mechanisms could result in the inability to detect threats/vulnerabilities High [Test: SI-3(1).1 - Central Management] Not Entered