3.0 Conclusion Table 3-1: Risks that must be Remediated within 30 days of ATO or Receive an Exception/Waiver Prior to ATO Exception / Risk Recommended Compensating Traceability Risks Affected Elements Waiver Level Remediation Measure Failure to ensure that the organization protects the information system from damage resulting from water [Test: PE-15.1 - Damage [Test: PE-15.1 - leakage by providing master Water Damage [E-# OR Protection [NIST Water Damage shutoff valves that are High Protection] W-#] 800-53 w/ DHS Protection] accessible, working properly, 4300A PE-15] and known to key personnel Not Entered Not Entered could lead to the compromise of the system or of the data in the system. Failure to meet the [Test: CA-1.1 - certification, accreditation, and Security Assessment [Test: CA-1.1 - security assessment policies and Authorization Security Assessment and procedures requirements Policies and Security and Authorization listed below could result in a Procedures] Assessment and Policies and weak security stance of the Authorization Procedures] organization due to security Not Entered [E-# OR Policies and threats that may not have been High W-#] Procedures [NIST Not Entered addressed accordingly or [Test: CA-1.2 - 800-53 w/ DHS completely by organizational Security Assessment 4300A CA-1] [Test: CA-1.2 - personnel with certification, and Authorization Security Assessment accreditation and assessment Policies and and Authorization roles and responsibilities: Procedures] Policies and Procedures] (i) the organization defines the Not Entered
3.0 Conclusion Table 3-1: Risks that must be Remediated within 30 days of ATO or Receive an Exception/Waiver Prior to ATO Exception / Waiver Traceability Risks Affected Elements Risk Level Recommended Remediation Compensating Measure [E-# OR W-#] Damage Protection [NIST 800-53 w/ DHS 4300A PE-15] [Test: PE-15.1 - Water Damage Protection] Not Entered Failure to ensure that the organization protects the information system from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly, and known to key personnel could lead to the compromise of the system or of the data in the system. High [Test: PE-15.1 - Water Damage Protection] Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS 4300A CA-1] [Test: CA-1.1 - Security Assessment and Authorization Policies and Procedures] Not Entered [Test: CA-1.2 - Security Assessment and Authorization Policies and Procedures] Failure to meet the certification, accreditation, and security assessment policies and procedures requirements listed below could result in a weak security stance of the organization due to security threats that may not have been addressed accordingly or completely by organizational personnel with certification, accreditation and assessment roles and responsibilities: (i) the organization defines the High [Test: CA-1.1 - Security Assessment and Authorization Policies and Procedures] Not Entered [Test: CA-1.2 - Security Assessment and Authorization Policies and Procedures] Not Entered
Security%20Assessment%20Report%20Extensible.docx