packages could leave the Response to ICCB] DHS 4300A CM-3 system vulnerable to (DHS-2.1.8.g)] unexpected instability in Not Entered Not Entered operation. Failure to meet the white listing requirements listed below could leave the system vulnerable to attacks and denial-of-service conditions: (i) the organization identifies software programs authorized [Test: CM-7(5).1 - Least Functionality to execute on the information [Test: CM-7(5).1 - Authorized Software / [E-# OR [NIST 800-53 w/ system; Authorized Software High Whitelisting] W-#] DHS 4300A CM-7 (ii) the organization employs a / Whitelisting] (5)] deny-all, permit-by-exception Not Entered policy to allow the execution of Not Entered authorized software programs on the information system; and, (iii) the organization reviews and updates the list of authorized software programs on an organization-defined frequency. Failure of the organization to update the baseline Baseline configuration of the [Test: CM-2(1).1 - Configuration [Test: CM-2(1).1 - information system as an Reviews And [E-# OR [NIST 800-53 w/ Reviews And integral part of information High Updates] W-#] DHS 4300A CM-2 Updates] system component installations (1)] could result in a weak security Not Entered Not Entered stance of the organization due to the untimely detection of
DHS 4300A CM-3 (DHS-2.1.8.g)] Response to ICCB] Not Entered packages could leave the system vulnerable to unexpected instability in operation. Not Entered [E-# OR W-#] Least Functionality [NIST 800-53 w/ DHS 4300A CM-7 (5)] [Test: CM-7(5).1 - Authorized Software / Whitelisting] Not Entered Failure to meet the white listing requirements listed below could leave the system vulnerable to attacks and denial-of-service conditions: (i) the organization identifies software programs authorized to execute on the information system; (ii) the organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and, (iii) the organization reviews and updates the list of authorized software programs on an organization-defined frequency. High [Test: CM-7(5).1 - Authorized Software / Whitelisting] Not Entered [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS 4300A CM-2 (1)] [Test: CM-2(1).1 - Reviews And Updates] Not Entered Failure of the organization to update the baseline configuration of the information system as an integral part of information system component installations could result in a weak security stance of the organization due to the untimely detection of High [Test: CM-2(1).1 - Reviews And Updates] Not Entered
Security%20Assessment%20Report%20Extensible.docx