20. Are unused services and non-essential ports disabled whenever possible? (Inquiry, observation ____ ____ ____ 543.20(e)(2) and review supporting documentation) 21. Are procedures implemented to ensure that all activity performed on systems is restricted and ____ ____ ____ 543.20(e)(3) secured from unauthorized access? (Inquiry and review supporting documentation) 22. Are procedures implemented to ensure that all activity performed on systems is logged? (Inquiry ____ ____ ____ 543.20(e)(3) and review supporting documentation) 23. Are communications to and from systems via Network Communication Equipment logically ____ ____ ____ 543.20(e)(4) secured from unauthorized access? (Inquiry and review supporting documentation) (f) User controls 24. Are systems, including application software, secured with passwords or other means for authorizing access? (Inquiry and perform log-in ____ ____ ____ 543.20(f)(1) tests on network system(s) and each stand-alone system) 25. Is access to system functions assigned and controlled only by management personnel or agents ____ ____ ____ 543.20(f)(2) independent of the department being controlled? (Inquiry and review supporting documentation) 26. Does each user have his or her own individual 543.20(f)(3) access credential (such as or ____ ____ ____ passwords, PIN’s, (i) cards)? (Inquiry) 27. Are access credentials changed at an established interval approved by the TGRA? (Inquiry, review 543.20(f)(3) ____ ____ ____ TGRA approval, and review other system (ii) – security settings) 28. Are access credential records maintained for each user either manually or by systems that 543.20(f)(3) automatically record access changes and force ____ ____ ____ (iii) access credential changes? (Inquiry and review supporting documentation)
20. Are unused services and non-essential ports disabled whenever possible? (Inquiry, observation and review supporting documentation) ____ ____ ____ 543.20(e)(2) 21. Are procedures implemented to ensure that all activity performed on systems is restricted and secured from unauthorized access? (Inquiry and review supporting documentation) ____ ____ ____ 543.20(e)(3) 22. Are procedures implemented to ensure that all activity performed on systems is logged? (Inquiry and review supporting documentation) ____ ____ ____ 543.20(e)(3) 23. Are communications to and from systems via Network Communication Equipment logically secured from unauthorized access? (Inquiry and review supporting documentation) ____ ____ ____ 543.20(e)(4) (f) User controls 24. Are systems, including application software, secured with passwords or other means for authorizing access? (Inquiry and perform log-in tests on network system(s) and each stand-alone system) ____ ____ ____ 543.20(f)(1) 25. Is access to system functions assigned and controlled only by management personnel or agents independent of the department being controlled? (Inquiry and review supporting documentation) ____ ____ ____ 543.20(f)(2) 26. Does each user have his or her own individual access credential (such as passwords, PIN’s, or cards)? (Inquiry) ____ ____ ____ 543.20(f)(3) (i) 27. Are access credentials changed at an established interval approved by the TGRA? (Inquiry, review TGRA approval, and review other – system security settings) ____ ____ ____ 543.20(f)(3) (ii) 28. Are access credential records maintained for each user either manually or by systems that automatically record access changes and force access credential changes? (Inquiry and review supporting documentation) ____ ____ ____ 543.20(f)(3) (iii)