(i) the organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs; and (ii) the organization documents the rationale for such access in the security plan for the information system. Failure to ensure that the organization retains older versions of baseline configurations as deemed [Test: CM-2(3).1 - Baseline [Test: CM-2(3).1 - necessary to support rollback Retention Of Previous [E-# OR Configuration Retention Of could result in a weak security High Configurations] W-#] [NIST 800-53 w/ Previous stance of the organization due DHS CM-2 (3)] Configurations] to the untimely detection of Not Entered misconfigured systems or of Not Entered systems that need configuration updates. Failure to meet the information system recovery and Information System reconstitution requirements [Test: CP-10(4).1 - Recovery and listed below could result in the [Test: CP-10(4).1 - Restore Within Time [E-# OR Reconstitution loss of system integrity or Restore Within Time High Period] W-#] [NIST 800-53 w/ stability, which could lead to Period] DHS 4300A CP-10 the disruption of critical Not Entered (4)] mission/business functions, Not Entered operations, and processes:
(i) the organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs; and (ii) the organization documents the rationale for such access in the security plan for the information system. [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS CM-2 (3)] [Test: CM-2(3).1 - Retention Of Previous Configurations] Not Entered Failure to ensure that the organization retains older versions of baseline configurations as deemed necessary to support rollback could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of systems that need configuration updates. High [Test: CM-2(3).1 - Retention Of Previous Configurations] Not Entered [E-# OR W-#] Information System Recovery and Reconstitution [NIST 800-53 w/ DHS 4300A CP-10 (4)] [Test: CP-10(4).1 - Restore Within Time Period] Not Entered Failure to meet the information system recovery and reconstitution requirements listed below could result in the loss of system integrity or stability, which could lead to the disruption of critical mission/business functions, operations, and processes: High [Test: CP-10(4).1 - Restore Within Time Period] Not Entered
Security%20Assessment%20Report%20Extensible.docx