w/ DHS 4300A result in the loss of system IA-8 (3)] Not Entered integrity. Failure of the components to provide adequate physical and information security for all System and DHS-owned Private Branch [Test: Communications [Test: Exchanges (PBX) could result - Private Protection Policy - Private in the inability of the key Branch [E-# OR and Procedures Branch organization personnel to High Exchange(PBX) W-#] [NIST 800-53 w/ Exchange(PBX) respond properly to an incident Protections] DHS SC-1 Protections] in a timely manner, which (DHS-4.4.1.a)] could lead to the disruption of Not Entered Not Entered critical mission/business functions, operations, and processes. Failure to ensure that the organization employs only information technology products on the FIPS [Test: SA-4(10).1 - products list for Acquisitions [NIST [Test: SA-4(10).1 - Use Of Approved Piv [E-# OR Personal Identity Verification 800-53 w/ DHS Use Of Approved Piv High Products] W-#] (PIV) capability implemented 4300A SA-4 (10)] Products] within organizational Not Entered information systems could lead Not Entered to the compromise of the system or of the data in the system. Security Planning Failure to ensure that systems [Test: Policy and that, as part of routine business, - Sensitive [E-# OR Procedures [NIST remove Sensitive PII in the [Test: High PII] W-#] 800-53 w/ DHS form of a CRE, e.g., routine - Sensitive 4300A PL-1 system-to-system transmissions PII] Not Entered of data (routine CREs) are
w/ DHS 4300A IA-8 (3)] Not Entered result in the loss of system integrity. [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS SC-1 (DHS-4.4.1.a)] [Test: - Private Branch Exchange(PBX) Protections] Not Entered Failure of the components to provide adequate physical and information security for all DHS-owned Private Branch Exchanges (PBX) could result in the inability of the key organization personnel to respond properly to an incident in a timely manner, which could lead to the disruption of critical mission/business functions, operations, and processes. High [Test: - Private Branch Exchange(PBX) Protections] Not Entered [E-# OR W-#] Acquisitions [NIST 800-53 w/ DHS 4300A SA-4 (10)] [Test: SA-4(10).1 - Use Of Approved Piv Products] Not Entered Failure to ensure that the organization employs only information technology products on the FIPS products list for Personal Identity Verification (PIV) capability implemented within organizational information systems could lead to the compromise of the system or of the data in the system. High [Test: SA-4(10).1 - Use Of Approved Piv Products] Not Entered [E-# OR W-#] Security Planning Policy and Procedures [NIST 800-53 w/ DHS 4300A PL-1 [Test: - Sensitive PII] Failure to ensure that systems that, as part of routine business, remove Sensitive PII in the form of a CRE, e.g., routine system-to-system transmissions of data (routine CREs) are High [Test: - Sensitive PII] Not Entered
Security%20Assessment%20Report%20Extensible.docx