indicated below could result in data compromise: (i) the organization assigns a risk designation to all positions [Test: PS-2.1 - within the organization; Position Risk (ii) the organization establishes Designation] [NIST 800-53 w/ Designation] a criteria for DHS PS-2] individuals filling Not Entered Not Entered organizational positions; and (iii) the organization defines the frequency of risk designation reviews and updates for organizational positions. Failure of the components to ensure that all executable code, including mobile code (e.g., ActiveX, JavaScript), is reviewed and approved by the Program Manager prior to the System and code being allowed to execute [Test: Information within the DHS environment [Test: - Use of [E-# OR Integrity Policy and could result in the inability to - Use of High Executable Code] W-#] Procedures [NIST detect threats/vulnerabilities Executable Code] 800-53 w/ DHS and exploits identified with and Not Entered SI-1 (DHS-5.4.5.c)] inherent in malicious codes Not Entered enabling any determined attacker or user to gain unauthorized access to the system, which could eventually lead to the loss of sensitive information or to the disruption
[NIST 800-53 w/ DHS PS-2] [Test: PS-2.1 - Position Risk Designation] Not Entered indicated below could result in data compromise: (i) the organization assigns a risk designation to all positions within the organization; (ii) the organization establishes a criteria for individuals filling organizational positions; and (iii) the organization defines the frequency of risk designation reviews and updates for organizational positions. Designation] Not Entered [E-# OR W-#] System and Information Integrity Policy and Procedures [NIST 800-53 w/ DHS SI-1 (DHS-5.4.5.c)] [Test: - Use of Executable Code] Not Entered Failure of the components to ensure that all executable code, including mobile code (e.g., ActiveX, JavaScript), is reviewed and approved by the Program Manager prior to the code being allowed to execute within the DHS environment could result in the inability to detect threats/vulnerabilities and exploits identified with and inherent in malicious codes enabling any determined attacker or user to gain unauthorized access to the system, which could eventually lead to the loss of sensitive information or to the disruption High [Test: - Use of Executable Code] Not Entered
Security%20Assessment%20Report%20Extensible.docx