standard penetration testing methods: pretest analysis on full knowledge of the target system; pretest identification of potential vulnerabilities based on pretest analysis; and, testing designed to determine exploitability of identified vulnerabilities. (iv) the organization agrees the rules of engagement before commencing penetration testing scenarios; Failure to ensure that the Information System information system implements [Test: CP-10(2).1 - Recovery and transaction recovery for [Test: CP-10(2).1 - Transaction [E-# OR Reconstitution systems that are Transaction High Recovery] W-#] [NIST 800-53 w/ could compromise data Recovery] DHS 4300A CP-10 integrity and availability, Not Entered (2)] should a system go down Not Entered unexpectedly. Failure to ensure that the Monitoring Physical [Test: PE-6(4).1 - organization monitors physical [E-# OR Access [NIST Monitoring Physical [Test: PE-6(4).1 - access to the information High W-#] w/ DHS Access To Monitoring Physical system in addition to the (4)] Information Systems] Access To physical access monitoring of
standard penetration testing methods: pretest analysis on full knowledge of the target system; pretest identification of potential vulnerabilities based on pretest analysis; and, testing designed to determine exploitability of identified vulnerabilities. (iv) the organization agrees the rules of engagement before commencing penetration testing scenarios; [E-# OR W-#] Information System Recovery and Reconstitution [NIST 800-53 w/ DHS 4300A CP-10 (2)] [Test: CP-10(2).1 - Transaction Recovery] Not Entered Failure to ensure that the information system implements transaction recovery for systems that are could compromise data integrity and availability, should a system go down unexpectedly. High [Test: CP-10(2).1 - Transaction Recovery] Not Entered [E-# OR W-#] Monitoring Physical Access [NIST w/ DHS (4)] [Test: PE-6(4).1 - Monitoring Physical Access To Failure to ensure that the organization monitors physical access to the information system in addition to the physical access monitoring of High [Test: PE-6(4).1 - Monitoring Physical Access To Information Systems]
Security%20Assessment%20Report%20Extensible.docx