awareness and response could prevent the immediate restoration of the system into Not Entered its stable working state should an attack occur. Failure to prevent users from executing [Test: AC-6(10).1 - [Test: AC-6(10).1 - privileged functions could Prohibit Least Privilege Prohibit leave the system vulnerable to Users [E-# OR [NIST 800-53 w/ From several risks including access High From Executing W-#] DHS 4300A AC-6 Executing Privileged by untrained or unauthorized Privileged Functions] (10)] Functions] personnel, improper configuration, or faulty Not Entered Not Entered monitoring. Failure to meet the vulnerability scanning requirement listed below could put the organization in weaker security posture that could result in unauthorized disclosure of information, [Test: RA-5(2).1 - greater compromise of the Vulnerability [Test: RA-5(2).1 - Update By Frequency system, or to other more severe [E-# OR Scanning [NIST Update By Frequency / To New Scan / security threats against the High W-#] 800-53 w/ DHS / Prior To New Scan / When Identified] organization: 4300A RA-5 (2)] When Identified] Not Entered (i) the organization defines the Not Entered frequency of updates for information system vulnerabilities scanned; and (ii) the organization updates the list of information system vulnerabilities scanned in
Not Entered awareness and response could prevent the immediate restoration of the system into its stable working state should an attack occur. [E-# OR W-#] Least Privilege [NIST 800-53 w/ DHS 4300A AC-6 (10)] [Test: AC-6(10).1 - Prohibit From Executing Privileged Functions] Not Entered Failure to prevent users from executing privileged functions could leave the system vulnerable to several risks including access by untrained or unauthorized personnel, improper configuration, or faulty monitoring. High [Test: AC-6(10).1 - Prohibit Users From Executing Privileged Functions] Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (2)] [Test: RA-5(2).1 - Update By Frequency / Prior To New Scan / When Identified] Not Entered Failure to meet the vulnerability scanning requirement listed below could put the organization in weaker security posture that could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization: (i) the organization defines the frequency of updates for information system vulnerabilities scanned; and (ii) the organization updates the list of information system vulnerabilities scanned in High [Test: RA-5(2).1 - Update By Frequency / To New Scan / When Identified] Not Entered
Security%20Assessment%20Report%20Extensible.docx