and employed can satisfy organization security requirements. Failure to ensure that the organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of [Test: AC-6.1 - Least Privilege [E-# OR [Test: AC-6.1 - Least users) which are necessary to Privilege] [NIST 800-53 w/ High W-#] Privilege] accomplish assigned tasks in DHS 4300A AC-6] accordance with organizational Not Entered Not Entered missions and business functions could result in the non-completion of critical and required tasks by users of the information system. Failure to ensure that the Identification and information system uses [Test: IA-2(3).1 - Authentication multifactor authentication for [Test: IA-2(3).1 - Local Access To [E-# OR (Organizational local access to privileged Local Access To High Privileged Accounts] W-#] Users) [NIST accounts could result in Privileged Accounts] w/ DHS 4300A providing any account access Not Entered IA-2 (3)] to critical or sensitive Not Entered information. Failure to meet the collaboration and information sharing requirements listed [Test: AC-21.1 - Collaboration and [E-# OR [Test: AC-21.1 - below could leave essential Information Sharing] Information Sharing High W-#] Information Sharing] data exposed to unauthorized [NIST 800-53 w/ access and viewing by Not Entered DHS 4300A AC-21] Not Entered individuals not connected to the organization:
and employed can satisfy organization security requirements. [E-# OR W-#] Least Privilege [NIST 800-53 w/ DHS 4300A AC-6] [Test: AC-6.1 - Least Privilege] Not Entered Failure to ensure that the organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions could result in the non-completion of critical and required tasks by users of the information system. High [Test: AC-6.1 - Privilege] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (3)] [Test: IA-2(3).1 - Local Access To Privileged Accounts] Not Entered Failure to ensure that the information system uses multifactor authentication for local access to privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(3).1 - Local Access To Privileged Accounts] Not Entered [E-# OR W-#] Collaboration and Information Sharing [NIST 800-53 w/ DHS 4300A AC-21] [Test: AC-21.1 - Information Sharing] Not Entered Failure to meet the collaboration and information sharing requirements listed below could leave essential data exposed to unauthorized access and viewing by individuals not connected to the organization: High [Test: AC-21.1 - Information Sharing] Not Entered
Security%20Assessment%20Report%20Extensible.docx