correct the deficiencies. capability, change (5.3) known default passwords and has OR identified deficiencies The Responsible Entity but did not assess or has implemented one or correct the deficiencies. more documented (5.4) process(es) for OR authentication for interactive user access The Responsible Entity that did not technically or has implemented one procedurally enforce one or more documented of the two password process(es) for System parameters as described in Access Controls but 5.5.1 and 5.5.2 and has did not, per device identified deficiencies but capability, change did not assess or correct known default the deficiencies. (5.5) passwords but did not identify, assess, or OR correct the deficiencies. The Responsible Entity (5.4) has implemented one or OR more documented process(es) for The Responsible Entity authentication for has implemented one interactive user access or more documented that did not technically or process(es) for procedurally enforce one password-only of the two password authentication for parameters as described in interactive user access 5.5.1 and 5.5.2 and did but the Responsible not identify, assess, or Entity did not correct the deficiencies. technically or (5.5) procedurally enforce all of the password OR parameters described in The Responsible Entity 5.5.1 and 5.5.2 and has has implemented one or identified deficiencies more documented but did not assess or process(es) for authentication for
correct the deficiencies. (5.3) OR The Responsible Entity has implemented one or more documented process(es) for authentication for interactive user access that did not technically or procedurally enforce one of the two password parameters as described in 5.5.1 and 5.5.2 and has identified deficiencies but did not assess or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for authentication for interactive user access that did not technically or procedurally enforce one of the two password parameters as described in 5.5.1 and 5.5.2 and did not identify, assess, or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for authentication for capability, change known default passwords and has identified deficiencies but did not assess or correct the deficiencies. (5.4) OR The Responsible Entity has implemented one or more documented process(es) for System Access Controls but did not, per device capability, change known default passwords but did not identify, assess, or correct the deficiencies. (5.4) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but the Responsible Entity did not technically or procedurally enforce all of the password parameters described in 5.5.1 and 5.5.2 and has identified deficiencies but did not assess or
VSL_Matrix_Complete_2016_01_27.docx