interactive user access but correct the deficiencies. did not technically or (5.5) procedurally enforce OR password changes or an The Responsible Entity obligation to change the has implemented one password within 17 or more documented calendar months but less process(es) for than or equal to 18 password-only calendar months of the authentication for last password change and interactive user access has identified deficiencies but the Responsible but did not assess or Entity did not correct the deficiencies. technically or (5.6) procedurally enforce all OR of the password The Responsible Entity parameters described in has implemented one or 5.5.1 and 5.5.2 and did more documented not identify, assess, or process(es) for correct the deficiencies. authentication for (5.5) interactive user access but OR did not technically or The Responsible Entity procedurally enforce has implemented one password changes or an or more documented obligation to change the process(es) for password within 17 password-only calendar months but less authentication for than or equal to 18 interactive user access calendar months of the but did not technically last password change and or procedurally enforce did not identify, assess, or password changes or an correct the deficiencies. obligation to change (5.6) the password within 18 calendar months of the last password change and has identified deficiencies but did not
interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 17 calendar months but less than or equal to 18 calendar months of the last password change and has identified deficiencies but did not assess or correct the deficiencies. (5.6) OR The Responsible Entity has implemented one or more documented process(es) for authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 17 calendar months but less than or equal to 18 calendar months of the last password change and did not identify, assess, or correct the deficiencies. (5.6) correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but the Responsible Entity did not technically or procedurally enforce all of the password parameters described in 5.5.1 and 5.5.2 and did not identify, assess, or correct the deficiencies. (5.5) OR The Responsible Entity has implemented one or more documented process(es) for password-only authentication for interactive user access but did not technically or procedurally enforce password changes or an obligation to change the password within 18 calendar months of the last password change and has identified deficiencies but did not
VSL_Matrix_Complete_2016_01_27.docx