(i) the organization prohibits the use of binary or code from sources with limited or no warranty and without the provision of source code; and (ii) the organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official. Failure to ensure that the [Test: PE-6(1).1 - organization monitors physical Monitoring Physical [Test: PE-6(1).1 - Intrusion Alarms / intrusion alarms and [E-# OR Access [NIST Intrusion Alarms / Surveillance surveillance equipment could High W-#] w/ DHS 4300A Surveillance Equipment] lead to the compromise of the PE-6 (1)] Equipment] system or to the disclosure of Not Entered information. Not Entered Failure to ensure that the Identification and information system uses [Test: IA-2(4).1 - Authentication [Test: IA-2(4).1 - multifactor authentication for Access To [E-# OR (Organizational Local Access To local access to non-privileged High Accounts] W-#] Users) [NIST Non-Privileged accounts could result in w/ DHS 4300A Accounts] providing any account access Not Entered IA-2 (4)] to critical or sensitive Not Entered information. Information Flow Failure of the information [Test: AC-4.1 - [E-# OR Enforcement [NIST system to use protected High Information Flow W-#] 800-53 w/ DHS [Test: AC-4.1 - processing domains result Enforcement] 4300A AC-4] Information Flow in an unsuitable, inaccurate or
(i) the organization prohibits the use of binary or code from sources with limited or no warranty and without the provision of source code; and (ii) the organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official. [E-# OR W-#] Monitoring Physical Access [NIST w/ DHS 4300A PE-6 (1)] [Test: PE-6(1).1 - Intrusion Alarms / Surveillance Equipment] Not Entered Failure to ensure that the organization monitors physical intrusion alarms and surveillance equipment could lead to the compromise of the system or to the disclosure of information. High [Test: PE-6(1).1 - Intrusion Alarms / Surveillance Equipment] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (4)] [Test: IA-2(4).1 - Local Access To Non-Privileged Accounts] Not Entered Failure to ensure that the information system uses multifactor authentication for local access to non-privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(4).1 - Access To Accounts] Not Entered [E-# OR W-#] Information Flow Enforcement [NIST 800-53 w/ DHS 4300A AC-4] [Test: AC-4.1 - Information Flow Failure of the information system to use protected processing domains result in an unsuitable, inaccurate or High [Test: AC-4.1 - Information Flow Enforcement]
Security%20Assessment%20Report%20Extensible.docx