Failure to meet the security assessments requirements listed could lead to compromise of the system or of the data in the system: (i) the organization develops a security assessment plan for the information system; and, (ii) the security assessment plan describes the scope of the Security [Test: CA-2.1 - assessment including: [Test: CA-2.1 - [E-# OR Assessments [NIST Security Assessments] Security High W-#] 800-53 w/ DHS security controls and Assessments] 4300A CA-2] Not Entered control enhancements under assessment; Not Entered assessment procedures to be used to determine security control effectiveness; and, assessment environment, assessment team, and assessment and responsibilities. Failure to ensure that the organization employs a [Test: AR-4.1 - Privacy Monitoring [Test: AR-4.1 - schedule to monitor and Privacy Monitoring [E-# OR and Auditing [NIST Privacy Monitoring privacy controls and internal High and Auditing] W-#] 800-53 w/ DHS and Auditing] privacy policy could result in PRIV-AR-4] the inability of the organization Not Entered Not Entered to track any security incident,
[E-# OR W-#] Security Assessments [NIST 800-53 w/ DHS 4300A CA-2] [Test: CA-2.1 - Security Assessments] Not Entered Failure to meet the security assessments requirements listed could lead to compromise of the system or of the data in the system: (i) the organization develops a security assessment plan for the information system; and, (ii) the security assessment plan describes the scope of the assessment including: security controls and control enhancements under assessment; assessment procedures to be used to determine security control effectiveness; and, assessment environment, assessment team, and assessment and responsibilities. High [Test: CA-2.1 - Security Assessments] Not Entered [E-# OR W-#] Privacy Monitoring and Auditing [NIST 800-53 w/ DHS PRIV-AR-4] [Test: AR-4.1 - Privacy Monitoring and Auditing] Not Entered Failure to ensure that the organization employs a schedule to monitor and privacy controls and internal privacy policy could result in the inability of the organization to track any security incident, High [Test: AR-4.1 - Privacy Monitoring and Auditing] Not Entered
Security%20Assessment%20Report%20Extensible.docx