loss of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes. Failure to ensure that the organization plans and coordinates security-related [Test: PL-2(3).1 - activities affecting the [Test: PL-2(3).1 - Plan / Coordinate System Security information system with Plan / Coordinate With [E-# OR Plan [NIST 800-53 organization-defined With Other High W-#] w/ DHS 4300A individuals or groups before Entities] (3)] conducting such activities in Entities] order to reduce the impact on Not Entered other organizational entities Not Entered could result in the loss of information. Failure to ensure that the organization incorporates the detection of unauthorized organization-defined changes to the [Test: SI-7(7).1 - Software and [Test: SI-7(7).1 - information system into the Integration Of Information [E-# OR Integration Of organizational incident Detection And Integrity [NIST High W-#] Detection And response capability could Response] 800-53 w/ DHS Response] permit an attacker or a 4300A SI-7 (7)] malicious user to gain Not Entered Not Entered unauthorized access to the system or data and could risk the loss of critical mission/business assets. [E-# OR Least Privilege Failure to meet the [Test: AC-6(1).1 - High W-#] [NIST 800-53 w/ privilege requirements listed Authorize Access To
loss of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes. [E-# OR W-#] System Security Plan [NIST 800-53 w/ DHS 4300A (3)] [Test: PL-2(3).1 - Plan / Coordinate With Other Entities] Not Entered Failure to ensure that the organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities could result in the loss of information. High [Test: PL-2(3).1 - Plan / Coordinate With Entities] Not Entered [E-# OR W-#] Software and Information Integrity [NIST 800-53 w/ DHS 4300A SI-7 (7)] [Test: SI-7(7).1 - Integration Of Detection And Response] Not Entered Failure to ensure that the organization incorporates the detection of unauthorized organization-defined changes to the information system into the organizational incident response capability could permit an attacker or a malicious user to gain unauthorized access to the system or data and could risk the loss of critical mission/business assets. High [Test: SI-7(7).1 - Integration Of Detection And Response] Not Entered [E-# OR W-#] Least Privilege [NIST 800-53 w/ Failure to meet the privilege requirements listed High [Test: AC-6(1).1 - Authorize Access To
Security%20Assessment%20Report%20Extensible.docx