measures to be employed to protect against supply chain threats; and (ii) the organization protects against supply chain threats by employing measures as part of a comprehensive, information security strategy. Failure to meet the configuration change control requirements listed below could lead to the compromise of the system or of the data in the system: [Test: Configuration [Test: (i) the Control Change Board - DHS Change Change Control [E-# OR - DHS (CCB) determines the types of Control [NIST 800-53 w/ High W-#] Change Control changes to the information Boards(CCB)] DHS 4300A CM-3 Boards(CCB)] system that are configuration (DHS-5.4.3.l)] controlled; and Not Entered Not Entered (ii) the CCB documents approved changes to the system, including DHS systems that interface with OneNet. Failure of the organization to Malicious Code [Test: SI-3(2).1 - automatically update malicious [E-# OR Protection [NIST Automatic Updates] code protection mechanisms High W-#] 800-53 w/ DHS [Test: SI-3(2).1 - result in the inability to SI-3 (2)] Automatic Updates] Not Entered detect in a timely fashion any
measures to be employed to protect against supply chain threats; and (ii) the organization protects against supply chain threats by employing measures as part of a comprehensive, information security strategy. [E-# OR W-#] Configuration Change Control [NIST 800-53 w/ DHS 4300A CM-3 (DHS-5.4.3.l)] [Test: - DHS Change Control Boards(CCB)] Not Entered Failure to meet the configuration change control requirements listed below could lead to the compromise of the system or of the data in the system: (i) the Control Change Board (CCB) determines the types of changes to the information system that are configuration controlled; and (ii) the CCB documents approved changes to the system, including DHS systems that interface with OneNet. High [Test: - DHS Change Control Boards(CCB)] Not Entered [E-# OR W-#] Malicious Code Protection [NIST 800-53 w/ DHS SI-3 (2)] [Test: SI-3(2).1 - Automatic Updates] Failure of the organization to automatically update malicious code protection mechanisms result in the inability to detect in a timely fashion any High [Test: SI-3(2).1 - Automatic Updates] Not Entered
Security%20Assessment%20Report%20Extensible.docx