multifactor authentication for network access to accounts could result in the absence of personnel [Test: IA-2(2).1 - responsibility and (Organizational Network Access To Non-Privileged accountability or in ineffective Users) [NIST Non-Privileged Accounts] identification and w/ DHS 4300A Accounts] authentication policy, which IA-2 (2)] Not Entered could lead to any attacker or Not Entered malicious user gaining unauthorized access to or elevated privileges on the system or the data. Failure to describe the specific conditions or circumstances Account under which information [Test: AC-2(11).1 - [E-# OR Management [NIST [Test: AC-2(11).1 - system accounts can be used Usage Conditions] High W-#] 800-53 w/ DHS Usage Conditions] could leave the system 4300A AC-2 (11)] vulnerable to improper Not Entered Not Entered utilization of resources due to unmonitored activity of access. Failure to meet the user identification and authentication requirements listed below could lead to any Device [Test: IA-3.1 - Device attacker or malicious user Identification and [Test: IA-3.1 - Identification and [E-# OR gaining unauthorized access to Authentication Device Identification High Authentication] W-#] or elevated privileges on the [NIST 800-53 w/ and Authentication] system or the data through DHS 4300A IA-3] Not Entered specific devices that the Not Entered information system could not properly identify/authorize:
(Organizational Users) [NIST w/ DHS 4300A IA-2 (2)] [Test: IA-2(2).1 - Network Access To Non-Privileged Accounts] Not Entered multifactor authentication for network access to accounts could result in the absence of personnel responsibility and accountability or in ineffective identification and authentication policy, which could lead to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data. Non-Privileged Accounts] Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2 (11)] [Test: AC-2(11).1 - Usage Conditions] Not Entered Failure to describe the specific conditions or circumstances under which information system accounts can be used could leave the system vulnerable to improper utilization of resources due to unmonitored activity of access. High [Test: AC-2(11).1 - Usage Conditions] Not Entered [E-# OR W-#] Device Identification and Authentication [NIST 800-53 w/ DHS 4300A IA-3] [Test: IA-3.1 - Device Identification and Authentication] Not Entered Failure to meet the user identification and authentication requirements listed below could lead to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data through specific devices that the information system could not properly identify/authorize: High [Test: IA-3.1 - Device Identification and Authentication] Not Entered
Security%20Assessment%20Report%20Extensible.docx