vulnerable to unauthorized access: (i) the organization defines the security functions or information to which users of information system accounts, or roles, have access; (ii) the organization requires that users of information Non-Privileged system accounts, or roles, with Access For Nonsecurity access to organization-defined DHS 4300A AC-6 Nonsecurity Functions] security functions or (2)] Functions] information, use Not Entered accounts, or roles, Not Entered when accessing other system functions; and, (iii) the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to security functions or security-relevant information, when accessing other system functions. Failure of the organization to employ automated mechanisms [Test: CM-5(1).1 - Access Restrictions [Test: CM-5(1).1 - to enforce access restrictions Automated Access [E-# OR for Change [NIST Automated Access and support auditing of the Enforcement / High W-#] 800-53 w/ DHS Enforcement / enforcement actions could Auditing] 4300A CM-5 (1)] Auditing] allow any user to effect system wide modification without Not Entered Not Entered being detected in a timely
DHS 4300A AC-6 (2)] Non-Privileged Access For Nonsecurity Functions] Not Entered vulnerable to unauthorized access: (i) the organization defines the security functions or information to which users of information system accounts, or roles, have access; (ii) the organization requires that users of information system accounts, or roles, with access to organization-defined security functions or information, use accounts, or roles, when accessing other system functions; and, (iii) the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to security functions or security-relevant information, when accessing other system functions. Nonsecurity Functions] Not Entered [E-# OR W-#] Access Restrictions for Change [NIST 800-53 w/ DHS 4300A CM-5 (1)] [Test: CM-5(1).1 - Automated Access Enforcement / Auditing] Not Entered Failure of the organization to employ automated mechanisms to enforce access restrictions and support auditing of the enforcement actions could allow any user to effect system wide modification without being detected in a timely High [Test: CM-5(1).1 - Automated Access Enforcement / Auditing] Not Entered
Security%20Assessment%20Report%20Extensible.docx