(AES) algorithms with at least 256 bit encryption that has been validated under FIPS 2 (Note: The use of triple DES [3DES] and FIPS 140-1 is no longer permitted.). (ii) NSA Type or Type 1 encryption. Failure to upgrade the existing Identification and physical and logical access Authentication [Test: control systems to use PIV Policy and [Test: - PIV [E-# OR credentials could weaken the Procedures [NIST - PIV High Credentials] W-#] overall security posture of the 800-53 w/ DHS Credentials] system due to lack of IA-1 Not Entered compliance to known standards Not Entered and policies. Failure to ensure that the confidentiality security object [Test: Security [Test: for Privacy Sensitive Systems - Categorization [E-# OR - are assigned an impact level of Confidentiality for [NIST 800-53 w/ High W-#] Confidentiality for moderate or higher could result Privacy Systems] DHS RA-2 Privacy Systems] in ineffective controls and (DHS-3.14.2.e)] increased information security Not Entered Not Entered risks. Failure to ensure that all DHS Security systems are authorized using [Test: Assessment and the approved automated IACS [Test: - Use of IACS Authorization tools by the DHS CISO could [E-# OR - Use of IACS for Security Policies and result in a weak security stance High W-#] for Security Authorization] Procedures [NIST of the organization due to Authorization] 800-53 w/ DHS security threats that may not Not Entered CA-1 (DHS-3.9.m)] have been addressed Not Entered accordingly or completely by
(AES) algorithms with at least 256 bit encryption that has been validated under FIPS (Note: The use of triple DES [3DES] and FIPS 140-1 is no longer permitted.). (ii) NSA Type 2 or Type 1 encryption. [E-# OR W-#] Identification and Authentication Policy and Procedures [NIST 800-53 w/ DHS IA-1 [Test: - PIV Credentials] Not Entered Failure to upgrade the existing physical and logical access control systems to use PIV credentials could weaken the overall security posture of the system due to lack of compliance to known standards and policies. High [Test: - PIV Credentials] Not Entered [E-# OR W-#] Security Categorization [NIST 800-53 w/ DHS RA-2 (DHS-3.14.2.e)] [Test: - Confidentiality for Privacy Systems] Not Entered Failure to ensure that the confidentiality security object for Privacy Sensitive Systems are assigned an impact level of moderate or higher could result in ineffective controls and increased information security risks. High [Test: - Confidentiality for Privacy Systems] Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS CA-1 (DHS-3.9.m)] [Test: - Use of IACS for Security Authorization] Not Entered Failure to ensure that all DHS systems are authorized using the approved automated IACS tools by the DHS CISO could result in a weak security stance of the organization due to security threats that may not have been addressed accordingly or completely by High [Test: - Use of IACS for Security Authorization] Not Entered
Security%20Assessment%20Report%20Extensible.docx