800-53 w/ DHS Credentials] security posture of the system 4300A IA-1 due to lack of compliance to Not Entered Not Entered known standards and policies. Security Failure to provide the proper Assessment and [Test: documentation to the Authorization [Test: - Usage of FedRAMP PMO regarding the [E-# OR Policies and - Usage of Public Cloud Service existence of all DHS cloud High W-#] Procedures [NIST Public Cloud Service Provider] services hosted in public CSPs 800-53 w/ DHS Provider] could weaken the overall 4300A CA-1 Not Entered security posture of the system. Not Entered Failure to immediately notify AOs when any security [Test: features are disabled in Continuous [Test: - AO response to time-sensitive, Monitoring [NIST - AO Notification on [E-# OR mission-critical incidents 800-53 w/ DHS Notification on High Disabling Security W-#] render the security controls 4300A CA-7 Disabling Security Features] useless and outdated when Features] examining recent or latest Not Entered threat information and Not Entered emerging vulnerabilities. Failure to meet the requirements listed below could lead to an attacker or a [Test: malicious user gaining Boundary [Test: - Permitted unauthorized access to the Protection [NIST - Permitted Protocols and [E-# OR system or data and could risk 800-53 w/ DHS Protocols and High Services for W-#] the loss of critical DHS assets. 4300A SC-7 Services for Component PEPs] Component PEPs] (i) components determined Not Entered protocols and services Not Entered permitted through their Component-level PEPs.
800-53 w/ DHS 4300A IA-1 Credentials] Not Entered security posture of the system due to lack of compliance to known standards and policies. Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS 4300A CA-1 [Test: - Usage of Public Cloud Service Provider] Not Entered Failure to provide the proper documentation to the FedRAMP PMO regarding the existence of all DHS cloud services hosted in public CSPs could weaken the overall security posture of the system. High [Test: - Usage of Public Cloud Service Provider] Not Entered [E-# OR W-#] Continuous Monitoring [NIST 800-53 w/ DHS 4300A CA-7 [Test: - AO Notification on Disabling Security Features] Not Entered Failure to immediately notify AOs when any security features are disabled in response to time-sensitive, mission-critical incidents render the security controls useless and outdated when examining recent or latest threat information and emerging vulnerabilities. High [Test: - AO Notification on Disabling Security Features] Not Entered [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 [Test: - Permitted Protocols and Services for Component PEPs] Not Entered Failure to meet the requirements listed below could lead to an attacker or a malicious user gaining unauthorized access to the system or data and could risk the loss of critical DHS assets. (i) components determined protocols and services permitted through their Component-level PEPs. High [Test: - Permitted Protocols and Services for Component PEPs] Not Entered
Security%20Assessment%20Report%20Extensible.docx