Failure to meet the audit generation requirements listed below could result in the loss of the generated audit data, which could render an audit or forensic investigation efforts useless: [Test: AU-12(3).1 - Audit Generation [Test: AU-12(3).1 - (i) the organization has the Changes By [E-# OR [NIST 800-53 w/ Changes By ability to extend or limit Authorized High W-#] DHS 4300A AU-12 Authorized auditing as necessary to meet Individuals] (3)] Individuals] organizational requirements; (ii) the organization establishes Not Entered Not Entered time thresholds in which audit actions are changed; and, (iii) information system provides the capability for authorized personnel to change organization-defined time thresholds. Failure to ensure that the information system implements organization-defined security safeguards to protect its [Test: SI-16.1 - Memory Protection memory from unauthorized [E-# OR [Test: SI-16.1 - Memory Protection] [NIST 800-53 w/ code execution could permit an High W-#] Memory Protection] DHS 4300A SI-16] attacker or a malicious user to Not Entered gain unauthorized access to the Not Entered system or data and could risk the loss of critical mission/business assets. [E-# OR Access Control for Failure of the organization to [Test: PE-4.1 - Access High W-#] Transmission control physical access to Control for
[E-# OR W-#] Audit Generation [NIST 800-53 w/ DHS 4300A AU-12 (3)] [Test: AU-12(3).1 - Changes By Authorized Individuals] Not Entered Failure to meet the audit generation requirements listed below could result in the loss of the generated audit data, which could render an audit or forensic investigation efforts useless: (i) the organization has the ability to extend or limit auditing as necessary to meet organizational requirements; (ii) the organization establishes time thresholds in which audit actions are changed; and, (iii) information system provides the capability for authorized personnel to change organization-defined time thresholds. High [Test: AU-12(3).1 - Changes By Authorized Individuals] Not Entered [E-# OR W-#] Memory Protection [NIST 800-53 w/ DHS 4300A SI-16] [Test: SI-16.1 - Memory Protection] Not Entered Failure to ensure that the information system implements organization-defined security safeguards to protect its memory from unauthorized code execution could permit an attacker or a malicious user to gain unauthorized access to the system or data and could risk the loss of critical mission/business assets. High [Test: SI-16.1 - Memory Protection] Not Entered [E-# OR W-#] Access Control for Transmission Failure of the organization to control physical access to High [Test: PE-4.1 - Access Control for
Security%20Assessment%20Report%20Extensible.docx