information system Partitioning] management functionality could lead to the instability of Not Entered Not Entered the system. Failure to meet the vulnerability scanning requirement listed below could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization: Vulnerability (i) the organization includes [Test: RA-5(5).1 - [E-# OR Scanning [NIST [Test: RA-5(5).1 - privileged access authorization Privileged Access] High W-#] 800-53 w/ DHS Privileged Access] to organization-defined 4300A RA-5 (5)] information system Not Entered Not Entered components identified for selected vulnerability scanning activities to facilitate more thorough scanning; and, (ii) the organization defines the list of information system components to which privileged access is authorized for selected vulnerability scanning activities. Failure of the organization to Incident Response [Test: IR-2(1).1 - incorporate simulated events [E-# OR Training [NIST Simulated Events] into incident response training High W-#] 800-53 w/ DHS [Test: IR-2(1).1 - to facilitate effective response IR-2 (1)] Simulated Events] Not Entered by personnel in crisis situations
Partitioning] Not Entered information system management functionality could lead to the instability of the system. Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (5)] [Test: RA-5(5).1 - Privileged Access] Not Entered Failure to meet the vulnerability scanning requirement listed below could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization: (i) the organization includes privileged access authorization to organization-defined information system components identified for selected vulnerability scanning activities to facilitate more thorough scanning; and, (ii) the organization defines the list of information system components to which privileged access is authorized for selected vulnerability scanning activities. High [Test: RA-5(5).1 - Privileged Access] Not Entered [E-# OR W-#] Incident Response Training [NIST 800-53 w/ DHS IR-2 (1)] [Test: IR-2(1).1 - Simulated Events] Failure of the organization to incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations High [Test: IR-2(1).1 - Simulated Events] Not Entered
Security%20Assessment%20Report%20Extensible.docx