could result in the inability to respond properly to an incident, leading to the disruption of Not Entered critical mission/business functions, operations, and processes. Failure to ensure that the organization employs vulnerability scanning tools [Test: RA-5(1).1 - Vulnerability that have the capability to [Test: RA-5(1).1 - Update Tool [E-# OR Scanning [NIST readily update the list of Update Tool High Capability] W-#] 800-53 w/ DHS information system Capability] 4300A RA-5 (1)] vulnerabilities scanned could Not Entered lead to exploitation by Not Entered attackers when users visit infected web sites. Failure to meet the organization issues public key [Test: SC-17.1 - Public Key certificates under an [Test: SC-17.1 - Public Key Infrastructure organization-defined certificate [E-# OR Public Key Infrastructure Certificates [NIST policy or obtains public key High W-#] Infrastructure Certificates] 800-53 w/ DHS certificates from an approved Certificates] SC-17] service provider could result in Not Entered the compromise of the system Not Entered or of the data in the system. Failure to ensure that the information system checks the [Test: SI-10.1 - Information Input validity of information inputs [Test: SI-10.1 - Information Input [E-# OR Validation [NIST could result in the loss of Information Input High Validation] W-#] 800-53 w/ DHS information system integrity Validation] 4300A SI-10] and stability, which could Not Entered eventually lead to the loss of Not Entered organizational assets or to the
Not Entered could result in the inability to respond properly to an incident, leading to the disruption of critical mission/business functions, operations, and processes. [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (1)] [Test: RA-5(1).1 - Update Tool Capability] Not Entered Failure to ensure that the organization employs vulnerability scanning tools that have the capability to readily update the list of information system vulnerabilities scanned could lead to exploitation by attackers when users visit infected web sites. High [Test: RA-5(1).1 - Update Tool Capability] Not Entered [E-# OR W-#] Public Key Infrastructure Certificates [NIST 800-53 w/ DHS SC-17] [Test: SC-17.1 - Public Key Infrastructure Certificates] Not Entered Failure to meet the organization issues public key certificates under an organization-defined certificate policy or obtains public key certificates from an approved service provider could result in the compromise of the system or of the data in the system. High [Test: SC-17.1 - Public Key Infrastructure Certificates] Not Entered [E-# OR W-#] Information Input Validation [NIST 800-53 w/ DHS 4300A SI-10] [Test: SI-10.1 - Information Input Validation] Not Entered Failure to ensure that the information system checks the validity of information inputs could result in the loss of information system integrity and stability, which could eventually lead to the loss of organizational assets or to the High [Test: SI-10.1 - Information Input Validation] Not Entered
Security%20Assessment%20Report%20Extensible.docx