use or sharing of PII; and (iv) the organization evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. Failure to meet the internal system connection requirements listed below could lead to compromise of the system or of the data in the system: [Test: CA-9.1 - Internal System (i) the organization authorizes [Test: CA-9.1 - Internal System [E-# OR Connections [NIST internal connections of system Internal System High Connections] W-#] 800-53 w/ DHS components or classes of Connections] 4300A CA-9] components to the information Not Entered system; and, Not Entered (ii) the organization documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated. Failure to meet the [Test: AT-1.1 - Security Awareness requirements for security Security Awareness and Training Policy [Test: AT-1.1 - awareness and training policy and Training Policy [E-# OR and Procedures Security Awareness and procedures indicated below High and Procedures] W-#] [NIST 800-53 w/ and Training Policy could result in the ignorance of DHS 4300A AT-1] and Procedures] basic security practices, which Not Entered could be taken advantage of by
use or sharing of PII; and (iv) the organization evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. [E-# OR W-#] Internal System Connections [NIST 800-53 w/ DHS 4300A CA-9] [Test: CA-9.1 - Internal System Connections] Not Entered Failure to meet the internal system connection requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization authorizes internal connections of system components or classes of components to the information system; and, (ii) the organization documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated. High [Test: CA-9.1 - Internal System Connections] Not Entered [E-# OR W-#] Security Awareness and Training Policy and Procedures [NIST 800-53 w/ DHS 4300A AT-1] [Test: AT-1.1 - Security Awareness and Training Policy and Procedures] Failure to meet the requirements for security awareness and training policy and procedures indicated below could result in the ignorance of basic security practices, which could be taken advantage of by High [Test: AT-1.1 - Security Awareness and Training Policy and Procedures] Not Entered
Security%20Assessment%20Report%20Extensible.docx