Support System (GSS) after transition; (iii) the organization requires an ISA whenever there is a difference in security categorizations for confidentiality, integrity and availability between systems or when systems do not share the same security policies; and, (iv) the organization assigns the Authorizing Officer to sign the ISA. Failure to monitor USGCB (or DHS-approved USGCB variant) compliance using a (NIST)-validated Security [Test: Configuration Content Automation Protocol [Test: - [E-# OR Settings [NIST (SCAP) tool could result in a - High Compliance] W-#] w/ DHS 4300A weak security stance of the Compliance] CM-6 (DHS-3.7.f)] organization due to the Not Entered untimely detection of Not Entered misconfigured systems or of systems that need configuration updates. Identification and Failure to ensure that the [Test: IA-8(3).1 - Use Authentication organization employs only Of [E-# OR [Test: IA-8(3).1 - Use FICAM-approved information High Products] W-#] Of system components to accept Users) [NIST Products] third-party credentials could Not Entered
Support System (GSS) after transition; (iii) the organization requires an ISA whenever there is a difference in security categorizations for confidentiality, integrity and availability between systems or when systems do not share the same security policies; and, (iv) the organization assigns the Authorizing Officer to sign the ISA. [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 (DHS-3.7.f)] [Test: - Compliance] Not Entered Failure to monitor USGCB (or DHS-approved USGCB variant) compliance using a (NIST)-validated Security Content Automation Protocol (SCAP) tool could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of systems that need configuration updates. High [Test: - Compliance] Not Entered [E-# OR W-#] Identification and Authentication Users) [NIST [Test: IA-8(3).1 - Use Of Products] Failure to ensure that the organization employs only FICAM-approved information system components to accept third-party credentials could High [Test: IA-8(3).1 - Use Of Products] Not Entered
Security%20Assessment%20Report%20Extensible.docx