Failure to meet the concurrent session control requirements listed below could enable an attacker to try and break into the system by hijacking the session and cause damage to the information system: [Test: AC-10.1 - Concurrent Session [Test: AC-10.1 - Concurrent Session [E-# OR Control [NIST (i) the organization defines the Concurrent Session High Control] W-#] w/ DHS 4300A maximum number of Control] AC-10] concurrent sessions to be Not Entered allowed for each system Not Entered account; and (ii) the information system limits the number of concurrent sessions for each system account to the number of sessions. Failure of the information system to automatically update spam protection mechanisms leaves the organization with an Spam Protection [Test: SI-8(2).1 - ineffective information system, [E-# OR [NIST 800-53 w/ [Test: SI-8(2).1 - Automatic Updates] could eventually lead to High W-#] DHS 4300A SI-8 Automatic Updates] the loss of organizational assets (2)] Not Entered or to the disruption of critical Not Entered mission/business functions, services, and operations/processes. Failure to ensure that the [Test: SA-9(2).1 - External [E-# OR organization requires providers Identification Of Information System High W-#] [Test: SA-9(2).1 - of organization-defined Functions / Ports / Services [NIST Identification Of external information system Protocols / Services]
[E-# OR W-#] Concurrent Session Control [NIST w/ DHS 4300A AC-10] [Test: AC-10.1 - Concurrent Session Control] Not Entered Failure to meet the concurrent session control requirements listed below could enable an attacker to try and break into the system by hijacking the session and cause damage to the information system: (i) the organization defines the maximum number of concurrent sessions to be allowed for each system account; and (ii) the information system limits the number of concurrent sessions for each system account to the number of sessions. High [Test: AC-10.1 - Concurrent Session Control] Not Entered [E-# OR W-#] Spam Protection [NIST 800-53 w/ DHS 4300A SI-8 (2)] [Test: SI-8(2).1 - Automatic Updates] Not Entered Failure of the information system to automatically update spam protection mechanisms leaves the organization with an ineffective information system, could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes. High [Test: SI-8(2).1 - Automatic Updates] Not Entered [E-# OR W-#] External Information System Services [NIST [Test: SA-9(2).1 - Identification Of Failure to ensure that the organization requires providers of organization-defined external information system High [Test: SA-9(2).1 - Identification Of Functions / Ports / Protocols / Services]
Security%20Assessment%20Report%20Extensible.docx