approval by the DHS PKIPA are obtained. Identification and Failure to maitain additional Authentication [Test: compensating controls for [Test: - Foreign [E-# OR foreign nationals could leave - Foreign High Nationals] W-#] the system vulnerable to Users) [NIST Nationals] unauthorized access and w/ DHS 4300A Not Entered intrusion. IA-8 (DHS-1.5.4.c)] Not Entered Failure of the components to manage systems to reduce vulnerabilities through vulnerability testing and Vulnerability [Test: management, promptly Scanning [NIST [Test: - ISVM [E-# OR installing patches, and 800-53 w/ DHS - ISVM High Compliance] W-#] eliminating or disabling 4300A RA-5 Compliance] unnecessary services could Not Entered result in weaker security Not Entered posture, which could lead to unauthorized disclosure of more information. Failure to ensure that a single public/private key pair is not Cryptographic Key used by an NPE for both [Test: Establishment and [Test: encryption and digital - PKI for [E-# OR Management [NIST - PKI for signature, whenever their High NPE] W-#] 800-53 w/ DHS NPE] separate use is supported by the 4300A SC-12 protocols native to the NPE Not Entered (DHS-5.5.3.b)] Not Entered could lead to the disclosure of critical DHS information/data. Cryptographic Key Failure to meet the subscriber [Test: [E-# OR Establishment and use of private key requirements High - Subscriber W-#] Management [NIST [Test: listed below could lead to the Use of Private Key]
approval by the DHS PKIPA are obtained. [E-# OR W-#] Identification and Authentication Users) [NIST w/ DHS 4300A IA-8 (DHS-1.5.4.c)] [Test: - Foreign Nationals] Not Entered Failure to maitain additional compensating controls for foreign nationals could leave the system vulnerable to unauthorized access and intrusion. High [Test: - Foreign Nationals] Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 [Test: - ISVM Compliance] Not Entered Failure of the components to manage systems to reduce vulnerabilities through vulnerability testing and management, promptly installing patches, and eliminating or disabling unnecessary services could result in weaker security posture, which could lead to unauthorized disclosure of more information. High [Test: - ISVM Compliance] Not Entered [E-# OR W-#] Cryptographic Key Establishment and Management [NIST 800-53 w/ DHS 4300A SC-12 (DHS-5.5.3.b)] [Test: - PKI for NPE] Not Entered Failure to ensure that a single public/private key pair is not used by an NPE for both encryption and digital signature, whenever their separate use is supported by the protocols native to the NPE could lead to the disclosure of critical DHS information/data. High [Test: - PKI for NPE] Not Entered [E-# OR W-#] Cryptographic Key Establishment and Management [NIST [Test: Failure to meet the subscriber use of private key requirements listed below could lead to the High [Test: - Subscriber Use of Private Key]
Security%20Assessment%20Report%20Extensible.docx