technically or correct the deficiencies. procedurally (5.5) enforce one of the OR two password The Responsible Entity parameters as has implemented one described in 5.5.1 or more documented and 5.5.2 and has process(es) for identified password-only deficiencies but authentication for did not assess or interactive user access correct the but the Responsible deficiencies. (5.5) Entity did not OR technically or The Responsible procedurally enforce all Entity has of the password implemented one parameters described in or more 5.5.1 and 5.5.2 and did documented not identify, assess, or process(es) for correct the deficiencies. password-only (5.5) authentication for OR interactive user The Responsible Entity access that did not has implemented one technically or or more documented procedurally process(es) for enforce one of the password-only two password authentication for parameters as interactive user access described in 5.5.1 but did not technically and 5.5.2 and did or procedurally enforce not identify, password changes or an assess, or correct obligation to change the deficiencies. the password within 18 (5.5) calendar months of the OR last password change The Responsible and has identified Entity has deficiencies but did not implemented one
technically or procedurally enforce one of the two password parameters as described in 5.5.1 and 5.5.2 and has identified deficiencies but did not assess or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access that did not technically or procedurally enforce one of the two password parameters as described in 5.5.1 and 5.5.2 and did not identify, assess, or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but the Responsible Entity did not technically or procedurally enforce all of the password parameters described in 5.5.1 and 5.5.2 and did not identify, assess, or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 18 calendar months of the last password change and has identified deficiencies but did not