malware prevention tools are not installed. The Responsible Entity shall R4.2. N/A N/A N/A The Responsible Entity document and implement a did not document or process for the update of did not implement a and malware prevention process including The process must “signatures.” addressing testing and address testing and installing the installing the signatures signatures. for the update of and malware prevention “signatures.” Account Management The — R5. N/A N/A N/A The Responsible Entity Responsible Entity shall did not document or establish, implement, and did not implement document technical and technical and procedural controls that enforce procedural controls that access authentication of, and enforce access accountability for, all user authentication of, and activity, and that minimize the accountability for, all risk of unauthorized system user activity. access. The Responsible Entity shall R5.1. N/A N/A N/A The Responsible Entity ensure that individual and shared did not ensure that system accounts and authorized individual and shared access permissions are consistent system accounts and with the concept of to “need authorized access with respect to work know” permissions are functions performed. consistent with the concept of to “need with respect to know” work functions performed. The Responsible Entity shall R5.1.1. N/A N/A N/A One or more user ensure that user accounts are accounts implemented implemented as approved by by the Responsible designated personnel. Refer to Entity were not
malware prevention tools are not installed. R4.2. The Responsible Entity shall document and implement a process for the update of and malware prevention “signatures.” The process must address testing and installing the signatures. N/A N/A N/A The Responsible Entity did not document or did not implement a process including addressing testing and installing the signatures for the update of and malware prevention “signatures.” R5. Account Management — The Responsible Entity shall establish, implement, and document technical and procedural controls that enforce access authentication of, and accountability for, all user activity, and that minimize the risk of unauthorized system access. N/A N/A N/A The Responsible Entity did not document or did not implement technical and procedural controls that enforce access authentication of, and accountability for, all user activity. R5.1. The Responsible Entity shall ensure that individual and shared system accounts and authorized access permissions are consistent with the concept of “need to know” with respect to work functions performed. N/A N/A N/A The Responsible Entity did not ensure that individual and shared system accounts and authorized access permissions are consistent with the concept of “need to know” with respect to work functions performed. R5.1.1. The Responsible Entity shall ensure that user accounts are implemented as approved by designated personnel. Refer to N/A N/A N/A One or more user accounts implemented by the Responsible Entity were not
VSL_Matrix_Complete_2016_01_01.docx