the deficiencies. with authorized capability, change (5.6) access to shared known default accounts and has passwords and has identified identified deficiencies deficiencies but but did not assess or did not assess or correct the deficiencies. correct the (5.4) deficiencies. (5.3) OR OR The Responsible Entity The Responsible has implemented one Entity has or more documented implemented one process(es) for System or more Access Controls but documented did not, per device process(es) for capability, change System Access known default Controls but, did passwords but did not not include the identify, assess, or identification of correct the deficiencies. the individuals (5.4) with authorized OR access to shared The Responsible Entity accounts and did has implemented one not identify, or more documented assess, or correct process(es) for the deficiencies. password-only (5.3) authentication for OR interactive user access The Responsible but the Responsible Entity has Entity did not implemented one technically or or more procedurally enforce all documented of the password process(es) for parameters described in password-only 5.5.1 and 5.5.2 and has authentication for identified deficiencies interactive user but did not assess or access that did not
the deficiencies. (5.6) with authorized access to shared accounts and has identified deficiencies but did not assess or correct the deficiencies. (5.3) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but, did not include the identification of the individuals with authorized access to shared accounts and did not identify, assess, or correct the deficiencies. (5.3) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access that did not capability, change known default passwords and has identified deficiencies but did not assess or correct the deficiencies. (5.4) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but did not, per device capability, change known default passwords but did not identify, assess, or correct the deficiencies. (5.4) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but the Responsible Entity did not technically or procedurally enforce all of the password parameters described in 5.5.1 and 5.5.2 and has identified deficiencies but did not assess or
VSL_Matrix_Complete_2016_01_01.docx