months of the password changes or an obligation to correct the correct the deficiencies. last password change the password within 16 deficiencies. (5.2) (R5) change and has calendar months but less than or OR OR identified equal to 17 calendar months of the The Responsible The Responsible Entity deficiencies but last password change and did not Entity has has implemented one did not assess or identify, assess, or correct the implemented one or more documented correct the deficiencies. (5.6) or more process(es) for System deficiencies. documented Access Controls but, (5.6) process(es) for where technically OR System Access feasible, does not have The Responsible Controls but, did a method(s) to enforce Entity has not include the authentication of implemented one identification or interactive user access or more inventory of all and has identified documented known enabled deficiencies but did not process(es) for default or other assess or correct the password-only generic account deficiencies. (5.1) authentication types, either by OR for interactive system, by groups The Responsible Entity user access but of systems, by has implemented one did not location, or by or more documented technically or system type(s) and process(es) for System procedurally did not identify, Access Controls but, enforce password assess, or correct where technically changes or an the deficiencies. feasible, does not have obligation to (5.2) a method(s) to enforce change the OR authentication of password within The Responsible interactive user access 15 calendar Entity has and did not identify, months but less implemented one assess, or correct the than or equal to or more deficiencies. (5.1) 16 calendar documented OR months of the process(es) for last password The Responsible Entity System Access change and did has implemented one Controls but, did not identify, or more documented not include the assess, or correct process(es) for System identification of Access Controls but the individuals did not, per device
months of the last password change and has identified deficiencies but did not assess or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 15 calendar months but less than or equal to 16 calendar months of the last password change and did not identify, assess, or correct password changes or an obligation to change the password within 16 calendar months but less than or equal to 17 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) correct the deficiencies. (5.2) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification or inventory of all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s) and did not identify, assess, or correct the deficiencies. (5.2) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification of the individuals correct the deficiencies. (R5) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access and has identified deficiencies but did not assess or correct the deficiencies. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access and did not identify, assess, or correct the deficiencies. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but did not, per device
VSL_Matrix_Complete_2016_01_01.docx