The Responsible Entity shall R5.2.2. N/A N/A N/A The Responsible Entity identify those individuals with did not identify all access to shared accounts. individuals with access to shared accounts. Where such accounts must be R5.2.3. N/A N/A N/A Where such accounts shared, the Responsible Entity must be shared, the shall have a policy for managing Responsible Entity has the use of such accounts that not implemented (one limits access to only those with or more components authorization, an audit trail of the of) a policy for account use (automated or managing the use of manual), and steps for securing such accounts that the account in the event of limits access to only personnel changes (for example, those with change in assignment or authorization, an audit termination). trail of the account use (automated or manual), and steps for securing the account in the event of personnel changes (for example, change in assignment or termination). At a minimum, the Responsible R5.3. N/A N/A N/A The Responsible Entity Entity shall require and use does not require passwords, subject to the passwords subject to following, as technically feasible: R5.3.1, R5.3.2, R5.3.3. OR Does not use passwords subject to R5.3.1, R5.3.2, R5.3.3. R5.3.1. Each password shall be a N/A N/A N/A N/A minimum of six characters. Each password shall consist of a R5.3.2. N/A N/A N/A N/A combination of alpha, numeric, and characters. “special”
R5.2.2. The Responsible Entity shall identify those individuals with access to shared accounts. N/A N/A N/A The Responsible Entity did not identify all individuals with access to shared accounts. R5.2.3. Where such accounts must be shared, the Responsible Entity shall have a policy for managing the use of such accounts that limits access to only those with authorization, an audit trail of the account use (automated or manual), and steps for securing the account in the event of personnel changes (for example, change in assignment or termination). N/A N/A N/A Where such accounts must be shared, the Responsible Entity has not implemented (one or more components of) a policy for managing the use of such accounts that limits access to only those with authorization, an audit trail of the account use (automated or manual), and steps for securing the account in the event of personnel changes (for example, change in assignment or termination). R5.3. At a minimum, the Responsible Entity shall require and use passwords, subject to the following, as technically feasible: N/A N/A N/A The Responsible Entity does not require passwords subject to R5.3.1, R5.3.2, R5.3.3. OR Does not use passwords subject to R5.3.1, R5.3.2, R5.3.3. R5.3.1. Each password shall be a minimum of six characters. N/A N/A N/A N/A R5.3.2. Each password shall consist of a combination of alpha, numeric, and “special” characters. N/A N/A N/A N/A
VSL_Matrix_Complete_2016_01_27.docx