Complies with this control Yes No N/A See Risk # Permitted Actions without Identification or Authentication (AC-14 (1)) No actions are permitted without identification and authentication. The User ID is used in conjunction with a password to determine whether a person is authorized to access a specific computer, application, database record, or file. Various audit records exists that record the User ID information; therefore, the person who accessed a computer or performed some action can be later identified, if necessary Complies with this control Yes No N/A See Risk # Remote Access (AC-17 (1) (2) (3) (4) (5) (7) (8)) Completion of form DTMB-0051 Remote Access Service Request is required. Remote access service is intended for MDE’s business purposes only and for use by MDE’s employees, DTMB employees and contractors who have demonstrated a business need for and have been approved to access information resources from a location that is not connected to the SOM network. Each remote access request is authorized by the appropriate Bureau Director, Office Director or Division Administrator. Agency and contractor employees requesting remote access to an Agency system sign a DTMB Employee Security Agreement or Acceptable Use Policy Letter. Remote users are required to use VPN for information encryption in transit and RSA SecurID tokens for authentication. Vendor personnel needing access to the system are required to utilize 2-factor authentication and use the jump server to gain access to system components. Unless there is an approved change, defined by the SOM Request for Change process, vendor accounts have no access to system components. All users are tracked in the Access Control Server (ACS) located in zone 2. Complies with this control Yes No N/A See Risk #
Complies with this control Yes No N/A See Risk # Permitted Actions without Identification or Authentication (AC-14 (1)) No actions are permitted without identification and authentication. The User ID is used in conjunction with a password to determine whether a person is authorized to access a specific computer, application, database record, or file. Various audit records exists that record the User ID information; therefore, the person who accessed a computer or performed some action can be later identified, if necessary Complies with this control Yes No N/A See Risk # Remote Access (AC-17 (1) (2) (3) (4) (5) (7) (8)) Completion of form DTMB-0051 Remote Access Service Request is required. Remote access service is intended for MDE’s business purposes only and for use by MDE’s employees, DTMB employees and contractors who have demonstrated a business need for and have been approved to access information resources from a location that is not connected to the SOM network. Each remote access request is authorized by the appropriate Bureau Director, Office Director or Division Administrator. Agency and contractor employees requesting remote access to an Agency system sign a DTMB Employee Security Agreement or Acceptable Use Policy Letter. Remote users are required to use VPN for information encryption in transit and RSA SecurID tokens for authentication. Vendor personnel needing access to the system are required to utilize 2-factor authentication and use the jump server to gain access to system components. Unless there is an approved change, defined by the SOM Request for Change process, vendor accounts have no access to system components. All users are tracked in the Access Control Server (ACS) located in zone 2. Complies with this control Yes No N/A See Risk #