of remote maintenance and [Test: MA-4(2).1 - diagnostic links in the security Document Nonlocal plan for the information system Maintenance] 800-53 w/ DHS Maintenance] could lead to the system losing 4300A MA-4 (2)] its integrity and stability or to Not Entered Not Entered the critical information/data being disclosed. Failure to ensure that the organization defines, documents, approves, and [Test: CM-5.1 - Access Restrictions [Test: CM-5.1 - enforces physical and logical Access Restrictions [E-# OR for Change [NIST Access Restrictions access restrictions associated High for Change] W-#] 800-53 w/ DHS for Change] with changes to the information 4300A CM-5] system could lead to the Not Entered Not Entered compromise of the system or of the data in the system: Failure to ensure that the Identification and information system implements [Test: IA-2(11).1 - Authentication multifactor authentication for [Test: IA-2(11).1 - Remote Access - [E-# OR (Organizational remote access to privileged and Remote Access - High Separate Device] W-#] Users) [NIST non-privileged accounts could Separate Device] w/ DHS 4300A result in providing any account Not Entered IA-2 (11)] access to critical or sensitive Not Entered information. Failure of the information system to provide the capability to include additional, [Test: AU-3(1).1 - Content of Audit [Test: AU-3(1).1 - more detailed information in Additional Audit [E-# OR Records [NIST Additional Audit the audit records for audit High Information] W-#] w/ DHS 4300A Information] events identified by type, AU-3 (1)] location, or subject could result Not Entered Not Entered in incomplete data critical to the success of a forensic
800-53 w/ DHS 4300A MA-4 (2)] [Test: MA-4(2).1 - Document Nonlocal Maintenance] Not Entered of remote maintenance and diagnostic links in the security plan for the information system could lead to the system losing its integrity and stability or to the critical information/data being disclosed. Maintenance] Not Entered [E-# OR W-#] Access Restrictions for Change [NIST 800-53 w/ DHS 4300A CM-5] [Test: CM-5.1 - Access Restrictions for Change] Not Entered Failure to ensure that the organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system could lead to the compromise of the system or of the data in the system: High [Test: CM-5.1 - Access Restrictions for Change] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (11)] [Test: IA-2(11).1 - Remote Access - Separate Device] Not Entered Failure to ensure that the information system implements multifactor authentication for remote access to privileged and non-privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(11).1 - Remote Access - Separate Device] Not Entered [E-# OR W-#] Content of Audit Records [NIST w/ DHS 4300A AU-3 (1)] [Test: AU-3(1).1 - Additional Audit Information] Not Entered Failure of the information system to provide the capability to include additional, more detailed information in the audit records for audit events identified by type, location, or subject could result in incomplete data critical to the success of a forensic High [Test: AU-3(1).1 - Additional Audit Information] Not Entered
Security%20Assessment%20Report%20Extensible.docx