and, (ii) use of a group User ID and password shall be approved by the appropriate Authorizing Official (AO). Failure to ensure that the information system (including modifications to the baseline [Test: Configuration [Test: configuration) demonstrates - Hardening Settings [NIST [E-# OR - Hardening conformance to security and Configuration w/ DHS High W-#] and Configuration configuration guidance, Guidance] CM-6 Guidance] weaken the overall security posture of the system due to Not Entered Not Entered lack of compliance to known standards and policies. Failure to ensure that the components whose systems collect, process, or store System and Protected Health Information Communications (PHI) is appropriately protected [Test: Protection Policy [Test: in compliance with HIPAA and - HIPAA [E-# OR and Procedures - HIPAA that access or disclosure is High Compliance] W-#] [NIST 800-53 w/ Compliance] limited to the minimum DHS SC-1 required could allow any Not Entered (DHS-3.17.a)] Not Entered personnel to obtain unauthorized or inappropriate access to applications and application data. Failure to meet the [Test: IA-5(1).1 - Authenticator authenticator management [E-# OR Management [NIST [Test: IA-5(1).1 - requirements listed below High Authentication] W-#] 800-53 w/ DHS could leave the system 4300A IA-5 (1)] Authentication] vulnerable to unauthorized Not Entered
and, (ii) use of a group User ID and password shall be approved by the appropriate Authorizing Official (AO). [E-# OR W-#] Configuration Settings [NIST w/ DHS CM-6 [Test: - Hardening and Configuration Guidance] Not Entered Failure to ensure that the information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance, weaken the overall security posture of the system due to lack of compliance to known standards and policies. High [Test: - Hardening and Configuration Guidance] Not Entered [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS SC-1 (DHS-3.17.a)] [Test: - HIPAA Compliance] Not Entered Failure to ensure that the components whose systems collect, process, or store Protected Health Information (PHI) is appropriately protected in compliance with HIPAA and that access or disclosure is limited to the minimum required could allow any personnel to obtain unauthorized or inappropriate access to applications and application data. High [Test: - HIPAA Compliance] Not Entered [E-# OR W-#] Authenticator Management [NIST 800-53 w/ DHS 4300A IA-5 (1)] [Test: IA-5(1).1 - Authentication] Failure to meet the authenticator management requirements listed below could leave the system vulnerable to unauthorized High [Test: IA-5(1).1 - Authentication] Not Entered