is a need for configuration changes to be implemented. Failure to ensure that the organization employs cryptographic mechanisms to protect the confidentiality and [Test: MP-5(4).1 - Media Transport [Test: MP-5(4).1 - integrity of information stored Cryptographic [E-# OR [NIST 800-53 w/ Cryptographic on digital media during High Protection] W-#] DHS 4300A MP-5 Protection] transport outside of controlled (4)] areas could lead to sensitive Not Entered Not Entered information or data to be modified and used by unauthorized users. Failure to meet the security impact analysis requirements listed below could lead to the compromise of the system or of the data in the system: (i) the organization analyzes [Test: CM-4(1).1 - Security Impact new software in a separate test [Test: CM-4(1).1 - Separate Test [E-# OR Analysis [NIST environment before installation Separate Test High Environments] W-#] 800-53 w/ DHS in an operational environment; Environments] 4300A CM-4 (1)] and Not Entered (ii) the organization, when Not Entered analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. [E-# OR Protection of Failure to meet the protection [Test: AU-9(4).1 - High W-#] Information [NIST of audit information Access By Subset Of
is a need for configuration changes to be implemented. [E-# OR W-#] Media Transport [NIST 800-53 w/ DHS 4300A MP-5 (4)] [Test: MP-5(4).1 - Cryptographic Protection] Not Entered Failure to ensure that the organization employs cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas could lead to sensitive information or data to be modified and used by unauthorized users. High [Test: MP-5(4).1 - Cryptographic Protection] Not Entered [E-# OR W-#] Security Impact Analysis [NIST 800-53 w/ DHS 4300A CM-4 (1)] [Test: CM-4(1).1 - Separate Test Environments] Not Entered Failure to meet the security impact analysis requirements listed below could lead to the compromise of the system or of the data in the system: (i) the organization analyzes new software in a separate test environment before installation in an operational environment; and (ii) the organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. High [Test: CM-4(1).1 - Separate Test Environments] Not Entered [E-# OR W-#] Protection of Information [NIST Failure to meet the protection of audit information High [Test: AU-9(4).1 - Access By Subset Of
Security%20Assessment%20Report%20Extensible.docx