Malicious individual gains Moderate Moderate Agency to document an audit and unauthorized access to accountability policy and procedure system and modifies for reviewing audit logs. Procedures information without being should include how often they are 11. Inadequate review detected or misuses reviewed, how long they are of audit logs resources of the retained and by whom system/application Compliance with NIST 800-53; AU-1 thru AU-12 12. Lack of PI/PII is located in zone 2 Access controls Low Moderate Segment PI/PII to zone 2P or zone 3 segmentation of PI/PII and not firewalled off which provides additional security from other zone 2 devices, logs controls which could result in: Compliance with NIST 800-53; Compromise of SC-32 Information System confidentiality, integrity Partitioning and availability of PI/PII.
11. Inadequate review of audit logs Malicious individual gains unauthorized access to system and modifies information without being detected or misuses resources of the system/application Moderate Moderate Agency to document an audit and accountability policy and procedure for reviewing audit logs. Procedures should include how often they are reviewed, how long they are retained and by whom Compliance with NIST 800-53; AU-1 thru AU-12 12. Lack of segmentation of PI/PII PI/PII is located in zone 2 and not firewalled off from other zone 2 devices, which could result in: Compromise of confidentiality, integrity and availability of PI/PII. Access controls logs Low Moderate Segment PI/PII to zone 2P or zone 3 which provides additional security controls Compliance with NIST 800-53; SC-32 Information System Partitioning