The Responsible Entity did not technically or Access Controls but, did correct the deficiencies. has implemented one or procedurally enforce password not include the (R5) more documented changes or an obligation to identification or inventory OR process(es) for change the password within 16 of all known enabled The Responsible Entity password-only calendar months but less than default or other generic has implemented one authentication for or equal to 17 calendar months account types, either by or more documented interactive user access of the last password change and system, by groups of process(es) for System but did not technically did not identify, assess, or systems, by location, or Access Controls but, or procedurally enforce correct the deficiencies. (5.6) by system type(s) and did where technically password changes or an not identify, assess, or feasible, does not have obligation to change the correct the deficiencies. a method(s) to enforce password within 15 (5.2) authentication of calendar months but OR interactive user access less than or equal to 16 The Responsible Entity and has identified calendar months of the has implemented one or deficiencies but did not last password change more documented assess or correct the and did not identify, process(es) for System deficiencies. (5.1) assess, or correct the Access Controls but, did OR deficiencies. (5.6) not include the The Responsible Entity identification of the has implemented one individuals with or more documented authorized access to process(es) for System shared accounts and has Access Controls but, identified deficiencies but where technically did not assess or correct feasible, does not have the deficiencies. (5.3) a method(s) to enforce OR authentication of The Responsible Entity interactive user access has implemented one or and did not identify, more documented assess, or correct the process(es) for System deficiencies. (5.1) Access Controls but, did OR not include the The Responsible Entity identification of the has implemented one individuals with or more documented authorized access to process(es) for System shared accounts and did Access Controls but not identify, assess, or did not, per device
The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 15 calendar months but less than or equal to 16 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) did not technically or procedurally enforce password changes or an obligation to change the password within 16 calendar months but less than or equal to 17 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) Access Controls but, did not include the identification or inventory of all known enabled default or other generic account types, either by system, by groups of systems, by location, or by system type(s) and did not identify, assess, or correct the deficiencies. (5.2) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification of the individuals with authorized access to shared accounts and has identified deficiencies but did not assess or correct the deficiencies. (5.3) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification of the individuals with authorized access to shared accounts and did not identify, assess, or correct the deficiencies. (R5) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access and has identified deficiencies but did not assess or correct the deficiencies. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, where technically feasible, does not have a method(s) to enforce authentication of interactive user access and did not identify, assess, or correct the deficiencies. (5.1) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but did not, per device
VSL_Matrix_Complete_2016_01_27.docx