accordance with the organization-defined frequency or when new vulnerabilities are identified and reported. Failure to ensure that the information system uses cryptographic mechanisms to protect the integrity of audit [Test: AU-9(3).1 - Protection of [Test: AU-9(3).1 - information and audit tools Cryptographic [E-# OR Information [NIST Cryptographic could result in the loss of High Protection] W-#] 800-53 w/ DHS Protection] integrity of the audit 4300A AU-9 (3)] information or of the audit Not Entered Not Entered tools, which could invalidate any result of forensic investigation. Failure to meet the penetration testing requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization conducts penetration testing in an [Test: CA-8.1 - Penetration Testing [E-# OR [Test: CA-8.1 - organizational-defined Penetration Testing] [NIST 800-53 w/ High W-#] Penetration Testing] frequency; DHS 4300A CA-8] (ii) the organization conducts Not Entered Not Entered penetration testing on information systems or individual system components to identify vulnerabilities that could be exploited by adversaries; (iii) the organization follows
accordance with the organization-defined frequency or when new vulnerabilities are identified and reported. [E-# OR W-#] Protection of Information [NIST 800-53 w/ DHS 4300A AU-9 (3)] [Test: AU-9(3).1 - Cryptographic Protection] Not Entered Failure to ensure that the information system uses cryptographic mechanisms to protect the integrity of audit information and audit tools could result in the loss of integrity of the audit information or of the audit tools, which could invalidate any result of forensic investigation. High [Test: AU-9(3).1 - Cryptographic Protection] Not Entered [E-# OR W-#] Penetration Testing [NIST 800-53 w/ DHS 4300A CA-8] [Test: CA-8.1 - Penetration Testing] Not Entered Failure to meet the penetration testing requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization conducts penetration testing in an organizational-defined frequency; (ii) the organization conducts penetration testing on information systems or individual system components to identify vulnerabilities that could be exploited by adversaries; (iii) the organization follows High [Test: CA-8.1 - Penetration Testing] Not Entered
Security%20Assessment%20Report%20Extensible.docx