Media access has few safeguards. During inspection of Dallas, If a backup tape is stolen, T-32, T-36 Restrict access to backup media; portal TX data center, backup then sensitive information digital media should be encrypted; require tapes were sitting on the will be disclosed. If backup media storage to establish & track records; top of servers and were tapes are lost, then it may require automated logging of record V3-MP(2) High Moderate Moderate not locked up. It is not be possible to restore access; state consequences for unknown who has files. unauthorized disclosure; require Privacy accessed the tapes. See Act controls; include definition of section 4.3 information system media. The personnel termination process is Review of System Security If someone on staff leaves T-7, T-23, Establish personnel termination not well defined. Plan and examination of the CSP, it is possible that T-24, T-32 procedures. Distinguish between friendly Resource procedures their account may not be and unfriendly terminations and describe for CSP. See Section 4.4 removed until long after the process for each type of V4-PS(4) Medium Medium Medium they have left the company terminations. which may enable unauthorized access to data.
V3-MP(2) Media access has few safeguards. During inspection of Dallas, TX data center, backup tapes were sitting on the top of servers and were not locked up. It is unknown who has accessed the tapes. See section 4.3 If a backup tape is stolen, then sensitive information will be disclosed. If backup tapes are lost, then it may not be possible to restore files. T-32, T-36 High Moderate Moderate Restrict access to backup media; portal digital media should be encrypted; require media storage to establish & track records; require automated logging of record access; state consequences for unauthorized disclosure; require Privacy Act controls; include definition of information system media. V4-PS(4) The personnel termination process is not well defined. Review of System Security Plan and examination of Resource procedures for CSP. See Section 4.4 If someone on staff leaves the CSP, it is possible that their account may not be removed until long after they have left the company which may enable unauthorized access to data. T-7, T-23, T-24, T-32 Medium Medium Medium Establish personnel termination procedures. Distinguish between friendly and unfriendly terminations and describe the process for each type of terminations.