the application must be identified individually. SA-9-COV-3 SYSTEM Each Agency shall (1) Perform an annual security audit of the environment or review the annual audit report of the environment conducted by an independent, third-party audit firm on an annual basis (2) Perform a monthly review of activity logs related to the operation of the service. At a minimum, the activity review must include the access time and action of each individual using the system during the review period. (3) Receive reports from the vendor on vulnerability scans of the operating system and supporting software at least once every 90-days CONTROL (4) Ensure that the vendor conduct an independent REQUIREMENT vulnerability scan of the service at least once every days and provide the results to Agency within (5) Submit a summary of all findings from the monthly activity log review once every 90-days to the appropriate regulatory authority (6) Submit the vulnerability scan information within of receipt from the vendor to the appropriate regulatory authority (7) Submit the results from the Data Owning Agency vulnerability scan of the service within 30 of scan completion Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one
the application must be identified individually. SA-9-COV-3 SYSTEM CONTROL REQUIREMENT Each Agency shall (1) Perform an annual security audit of the environment or review the annual audit report of the environment conducted by an independent, third-party audit firm on an annual basis (2) Perform a monthly review of activity logs related to the operation of the service. At a minimum, the activity review must include the access time and action of each individual using the system during the review period. (3) Receive reports from the vendor on vulnerability scans of the operating system and supporting software at least once every 90-days (4) Ensure that the vendor conduct an independent vulnerability scan of the service at least once every and provide the results to Agency within (5) Submit a summary of all findings from the monthly activity log review once every 90-days to the appropriate regulatory authority (6) Submit the vulnerability scan information within of receipt from the vendor to the appropriate regulatory authority (7) Submit the results from the Data Owning Agency vulnerability scan of the service within 30 days of scan completion Implementation Status: Implemented Planned Common Enter text in order to provide detailed information regarding the implementation strategy. If control is specific to one
SSP_FINAL.docx