![](media/image1.png){width="2.9375in"
height="1.1041666666666667in"}**Department of Health & Human Services**

Centers for Medicare & Medicaid Services

7500 Security Boulevard, Mail Stop N2-14-26

Baltimore, Maryland 21244-1850

######## CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) {#centers-for-medicare-medicaid-services-cms .unnumbered}

***Office of Information Services (OIS)***

***Security and Standards Group (SSG)***

7500 Security Blvd

Baltimore, MD 21244-1850

***CMS Information Security Threat Identification Workbook (TIW)***

***For Major Applications***

***Version 1.2***

**January 23, 2003**

**Table of Contents**

[1. HOW TO USE THIS WORKBOOK 2](#how-to-use-this-workbook)

[2. HUMAN THREATS 3](#human-threats-1)

[2.1. Data Entry Errors or Omissions 3](#data-entry-errors-or-omissions)

[2.2. Inadvertent Acts or Carelessness
4](#inadvertent-acts-or-carelessness)

[2.3. Impersonation 5](#impersonation)

[2.4. Shoulder Surfing 7](#shoulder-surfing)

[2.5. User Abuse or Fraud 8](#user-abuse-or-fraud)

[2.6. Theft, Sabotage, Vandalism, or Physical Intrusions
9](#theft-sabotage-vandalism-or-physical-intrusions)

[2.7. Espionage 11](#espionage)

[2.8. Other Threats 12](#other-threats)

[3. TECHNICAL THREATS 13](#technical-threats)

[3.1. Misrepresentation of Identity 13](#misrepresentation-of-identity)

[3.2. Intrusion or Unauthorized Access to System Resources
15](#intrusion-or-unauthorized-access-to-system-resources)

[3.3. Data/System Contamination 17](#datasystem-contamination)

[3.4. Eavesdropping 18](#eavesdropping)

[3.5. Insertion of Malicious Code/Software; or Unauthorized Modification
of a Database
19](#insertion-of-malicious-codesoftware-or-unauthorized-modification-of-a-database)

[3.6. Takeover of Authorized Session
21](#takeover-of-authorized-session)

[3.7. System and Application Errors, Failures, and Intrusions not
Properly Audited and Logged
22](#system-and-application-errors-failures-and-intrusions-not-properly-audited-and-logged)

[3.8. Other Threats 23](#other-threats-1)

# HOW TO USE THIS WORKBOOK

This workbook is based on the CMS Threat Identification Resource.
Specific questions have been developed to provide guidance in
identifying some of the risks that may affect the major application
under development. All of the questions should be answered in the spaces
provided. Additional questions may be identified by the system developer
and should be included with the corresponding responses. This workbook
provides guidance. It is not and cannot be the sole source for
vulnerabilities and risks to major applications.

Once all of the questions have been answered, the system developer
should refer to the Risk Assessment Methodology and Template to record
and analyze risks to the system resulting from the threats identified.

Threats to major applications are described in the tables on the
following pages. Questions and spaces for responses to those questions
are included. All questions should be answered to complete the process.
If a question does not apply, enter "not applicable" with a short
explanation.

+-------------+-------------+------------------------------------------+
| ####        |             |                                          |
| # HUMAN THR |             |                                          |
| EATS {#huma |             |                                          |
| n-threats . |             |                                          |
| unnumbered} |             |                                          |
+-------------+-------------+------------------------------------------+
| ###         | ##          | ##### EXAMPLES {#examples .unnumbered}   |
| ## THREATS  | ### DESCRIP |                                          |
| {#threats . | TIONS {#des |                                          |
| unnumbered} | criptions . |                                          |
|             | unnumbered} |                                          |
+-------------+-------------+------------------------------------------+
| ## Data Ent | Data entry  | Failure to disable or delete unnecessary |
| ry Errors o | errors and  | accounts, such as guest accounts and     |
| r Omissions | omissions   | employees that no longer need access to  |
|             | are         | system resources could result in         |
| *[System    | mistakes in | unauthorized access to sensitive data.   |
| Impact]{.   | keying or   |                                          |
| underline}* | oversight   | Entering incorrect values for sensitive  |
|             | to key      | information such as SSN, financial data  |
| Could       | data, which | or personally identifiable data could    |
| si          | could       | result in data inconsistency.            |
| gnificantly | affect      |                                          |
| impact data | system      | Innocent data entry errors could result  |
| integrity,  | resources   | in spelling inconsistencies, which could |
| and to a    | and the     | make accurate reporting, or standard     |
| lesser      | safeguards  | searches impossible.                     |
| extent data | that are    |                                          |
| av          | protecting  |                                          |
| ailability. | other       |                                          |
|             | system      |                                          |
|             | resources.  |                                          |
+-------------+-------------+------------------------------------------+
| **[QU       |             | **[RESPONSES]{.underline}**              |
| ESTIONS]{.u |             |                                          |
| nderline}** |             | **[(Each response should be entered in a |
|             |             | Detailed Risk Description                |
| **          |             | Chart)]{.underline}**                    |
| [Additional |             |                                          |
| questions   |             |                                          |
| specific to |             |                                          |
| the system  |             |                                          |
| under       |             |                                          |
| review may  |             |                                          |
| be added in |             |                                          |
| this        |             |                                          |
| s           |             |                                          |
| ection.]{.u |             |                                          |
| nderline}** |             |                                          |
+-------------+-------------+------------------------------------------+
| How is the  |             | \[Click here and Type Response\]         |
| system      |             |                                          |
| protected   |             |                                          |
| from data   |             |                                          |
| input       |             |                                          |
| errors by   |             |                                          |
| end users?  |             |                                          |
+-------------+-------------+------------------------------------------+
| How is the  |             | \[Click here and Type Response\]         |
| system      |             |                                          |
| protected   |             |                                          |
| from data   |             |                                          |
| input       |             |                                          |
| errors by   |             |                                          |
| system      |             |                                          |
| maintainers |             |                                          |
| or system   |             |                                          |
| admi        |             |                                          |
| nistrators? |             |                                          |
+-------------+-------------+------------------------------------------+
| How is the  |             | \[Click here and Type Response\]         |
| system      |             |                                          |
| protected   |             |                                          |
| from data   |             |                                          |
| input       |             |                                          |
| errors by   |             |                                          |
| supervisors |             |                                          |
| or super    |             |                                          |
| users?      |             |                                          |
+-------------+-------------+------------------------------------------+
| What are    |             | \[Click here and Type Response\]         |
| the         |             |                                          |
| controls in |             |                                          |
| place to    |             |                                          |
| disable and |             |                                          |
| delete      |             |                                          |
| unnecessary |             |                                          |
| accounts?   |             |                                          |
+-------------+-------------+------------------------------------------+

# HUMAN THREATS 

  --------------------------- -------------------------------------------
  \[Click here and Type       \[Click here and Type Response\]
  Additional Questions\]      

  --------------------------- -------------------------------------------

+-------------+-------------+------------------------------------------+
| #####       |             |                                          |
| HUMAN THREA |             |                                          |
| TS {#human- |             |                                          |
| threats-2 . |             |                                          |
| unnumbered} |             |                                          |
+-------------+-------------+------------------------------------------+
| #####       | ####        | ##### EXAMPLES {#examples-1 .unnumbered} |
|  THREATS {# | # DESCRIPTI |                                          |
| threats-1 . | ONS {#descr |                                          |
| unnumbered} | iptions-1 . |                                          |
|             | unnumbered} |                                          |
+-------------+-------------+------------------------------------------+
| ##          | Inadvertent | Programming and development errors       |
|  Inadverten | acts or     | result in software vulnerabilities.      |
| t Acts or C | c           | Successful compromise could lead to loss |
| arelessness | arelessness | of data confidentiality, integrity, and  |
|             | are         | availability.                            |
| *[System    | un          |                                          |
| Impact]{.   | intentional | Incorrect operations of database         |
| underline}* | acts that   | synchronization procedures could result  |
|             | could cause | in data errors including entry,          |
| Could       | system      | deletion, and corruption errors.         |
| si          | performance |                                          |
| gnificantly | degradation | Improper upgrades to database management |
| impact data | or system   | software could result in vulnerabilities |
| confi       | loss.       | that could impact data confidentiality,  |
| dentiality, |             | integrity, and availability.             |
| integrity,  |             |                                          |
| and         |             |                                          |
| av          |             |                                          |
| ailability. |             |                                          |
+-------------+-------------+------------------------------------------+
| **[QU       |             | **[RESPONSES]{.underline}**              |
| ESTIONS]{.u |             |                                          |
| nderline}** |             | **[(Each response should be entered in a |
|             |             | Detailed Risk Description                |
| **          |             | Chart)]{.underline}**                    |
| [Additional |             |                                          |
| questions   |             |                                          |
| specific to |             |                                          |
| the system  |             |                                          |
| under       |             |                                          |
| review may  |             |                                          |
| be added in |             |                                          |
| this        |             |                                          |
| s           |             |                                          |
| ection.]{.u |             |                                          |
| nderline}** |             |                                          |
+-------------+-------------+------------------------------------------+
| How is the  |             | \[Click here and Type Response\]         |
| system      |             |                                          |
| protected   |             |                                          |
| from        |             |                                          |
| inadvertent |             |                                          |
| acts or     |             |                                          |
| ca          |             |                                          |
| relessness? |             |                                          |
+-------------+-------------+------------------------------------------+
| Are there   |             | \[Click here and Type Response\]         |
| any         |             |                                          |
| procedures  |             |                                          |
| in place to |             |                                          |
| check       |             |                                          |
| programming |             |                                          |
| errors?     |             |                                          |
| e.g., Error |             |                                          |
| detection   |             |                                          |
| methods.    |             |                                          |
+-------------+-------------+------------------------------------------+
| Are there   |             | \[Click here and Type Response\]         |
| any         |             |                                          |
| procedures  |             |                                          |
| in place to |             |                                          |
| check data  |             |                                          |
| integrity?  |             |                                          |
| e.g., Hash  |             |                                          |
| value       |             |                                          |
| checks.     |             |                                          |
+-------------+-------------+------------------------------------------+
| What are    |             | \[Click here and Type Response\]         |
| the         |             |                                          |
| controls in |             |                                          |
| place to    |             |                                          |
| check       |             |                                          |
| database    |             |                                          |
| sync        |             |                                          |
| hronization |             |                                          |
| errors?     |             |                                          |
+-------------+-------------+------------------------------------------+
| What are    |             | \[Click here and Type Response\]         |
| the         |             |                                          |
| procedural  |             |                                          |
| controls in |             |                                          |
| place for   |             |                                          |
| upgrading   |             |                                          |
| database    |             |                                          |
| management  |             |                                          |
| system      |             |                                          |
| software?   |             |                                          |
+-------------+-------------+------------------------------------------+
| How is data |             | \[Click here and Type Response\]         |
| validated   |             |                                          |
| prior to    |             |                                          |
| performing  |             |                                          |
| queries or  |             |                                          |
| updates on  |             |                                          |
| databases?  |             |                                          |
+-------------+-------------+------------------------------------------+
| \[Click     |             | \[Click here and Type Response\]         |
| here and    |             |                                          |
| Type        |             |                                          |
| Additional  |             |                                          |
| Questions\] |             |                                          |
+-------------+-------------+------------------------------------------+

+-----------+-----------------------+---+--------------------------------+
| #####     |                       |   |                                |
|  HUMAN TH |                       |   |                                |
| REATS {#h |                       |   |                                |
| uman-thre |                       |   |                                |
| ats-3 .un |                       |   |                                |
| numbered} |                       |   |                                |
+-----------+-----------------------+---+--------------------------------+
| ##        | #####                 | # |                                |
| ### THREA | DESCRIPTIONS {#descri | # |                                |
| TS {#thre | ptions-2 .unnumbered} | # |                                |
| ats-2 .un |                       | # |                                |
| numbered} |                       | # |                                |
|           |                       |   |                                |
|           |                       | E |                                |
|           |                       | X |                                |
|           |                       | A |                                |
|           |                       | M |                                |
|           |                       | P |                                |
|           |                       | L |                                |
|           |                       | E |                                |
|           |                       | S |                                |
|           |                       |   |                                |
|           |                       | { |                                |
|           |                       | # |                                |
|           |                       | e |                                |
|           |                       | x |                                |
|           |                       | a |                                |
|           |                       | m |                                |
|           |                       | p |                                |
|           |                       | l |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | - |                                |
|           |                       | 2 |                                |
|           |                       |   |                                |
|           |                       | . |                                |
|           |                       | u |                                |
|           |                       | n |                                |
|           |                       | n |                                |
|           |                       | u |                                |
|           |                       | m |                                |
|           |                       | b |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | d |                                |
|           |                       | } |                                |
+-----------+-----------------------+---+--------------------------------+
| ## Impe   | Impersonations are    |   | Sharing of badges, key cards,  |
| rsonation | threats that often    |   | and PINs could provide an      |
|           | become enablers for   |   | employee or cardholder with    |
| *[System  | other threats.        |   | unauthorized access to         |
| Im        | Impersonation for     |   | sensitive information.         |
| pact]{.un | physical access could |   |                                |
| derline}* | include misuse of     |   | Forged documents could form    |
|           | badges, key cards,    |   | the basis for data entry,      |
| Could     | Personal              |   | modification, or deletion.     |
| sign      | Identification        |   |                                |
| ificantly | Numbers (PIN), etc.   |   | Social engineering such as     |
| impact    |                       |   | tricking employees into        |
| data      | Impersonation for     |   | revealing passwords or other   |
| confide   | electronic or system  |   | information can compromise a   |
| ntiality, | access could include  |   | target system's security.      |
| and to a  | use of others'        |   |                                |
| lesser    | identification and    |   |                                |
| extent    | authentication        |   |                                |
| data      | information in an     |   |                                |
| integrity | attempt to gain       |   |                                |
| and       | system privileges and |   |                                |
| avai      | access to system      |   |                                |
| lability. | resources.            |   |                                |
+-----------+-----------------------+---+--------------------------------+
| **[QUESTI |                       | * |                                |
| ONS]{.und |                       | * |                                |
| erline}** |                       | [ |                                |
|           |                       | R |                                |
| **[A      |                       | E |                                |
| dditional |                       | S |                                |
| questions |                       | P |                                |
| specific  |                       | O |                                |
| to the    |                       | N |                                |
| system    |                       | S |                                |
| under     |                       | E |                                |
| review    |                       | S |                                |
| may be    |                       | ] |                                |
| added in  |                       | { |                                |
| this      |                       | . |                                |
| secti     |                       | u |                                |
| on.]{.und |                       | n |                                |
| erline}** |                       | d |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | l |                                |
|           |                       | i |                                |
|           |                       | n |                                |
|           |                       | e |                                |
|           |                       | } |                                |
|           |                       | * |                                |
|           |                       | * |                                |
|           |                       |   |                                |
|           |                       | * |                                |
|           |                       | * |                                |
|           |                       | [ |                                |
|           |                       | ( |                                |
|           |                       | E |                                |
|           |                       | a |                                |
|           |                       | c |                                |
|           |                       | h |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | h |                                |
|           |                       | o |                                |
|           |                       | u |                                |
|           |                       | l |                                |
|           |                       | d |                                |
|           |                       | b |                                |
|           |                       | e |                                |
|           |                       | e |                                |
|           |                       | n |                                |
|           |                       | t |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | d |                                |
|           |                       | i |                                |
|           |                       | n |                                |
|           |                       | a |                                |
|           |                       | D |                                |
|           |                       | e |                                |
|           |                       | t |                                |
|           |                       | a |                                |
|           |                       | i |                                |
|           |                       | l |                                |
|           |                       | e |                                |
|           |                       | d |                                |
|           |                       | R |                                |
|           |                       | i |                                |
|           |                       | s |                                |
|           |                       | k |                                |
|           |                       | D |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | c |                                |
|           |                       | r |                                |
|           |                       | i |                                |
|           |                       | p |                                |
|           |                       | t |                                |
|           |                       | i |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | C |                                |
|           |                       | h |                                |
|           |                       | a |                                |
|           |                       | r |                                |
|           |                       | t |                                |
|           |                       | ) |                                |
|           |                       | ] |                                |
|           |                       | { |                                |
|           |                       | . |                                |
|           |                       | u |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | l |                                |
|           |                       | i |                                |
|           |                       | n |                                |
|           |                       | e |                                |
|           |                       | } |                                |
|           |                       | * |                                |
|           |                       | * |                                |
+-----------+-----------------------+---+--------------------------------+
| How is    |                       | \ |                                |
| the       |                       | [ |                                |
| system    |                       | C |                                |
| protected |                       | l |                                |
| from      |                       | i |                                |
| una       |                       | c |                                |
| uthorized |                       | k |                                |
| physical  |                       | h |                                |
| access?   |                       | e |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| How is    |                       | \ |                                |
| the       |                       | [ |                                |
| una       |                       | C |                                |
| uthorized |                       | l |                                |
| use of    |                       | i |                                |
| Logon IDs |                       | c |                                |
| co        |                       | k |                                |
| ntrolled? |                       | h |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| What are  |                       | \ |                                |
| the       |                       | [ |                                |
| controls  |                       | C |                                |
| in place  |                       | l |                                |
| to        |                       | i |                                |
| aut       |                       | c |                                |
| henticate |                       | k |                                |
| client    |                       | h |                                |
| users to  |                       | e |                                |
| the       |                       | r |                                |
| server?   |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| How are   |                       | \ |                                |
| printed   |                       | [ |                                |
| documents |                       | C |                                |
| or        |                       | l |                                |
| reports   |                       | i |                                |
| (if any)  |                       | c |                                |
| protected |                       | k |                                |
| from      |                       | h |                                |
| being     |                       | e |                                |
| forged?   |                       | r |                                |
|           |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| How is    |                       | \ |                                |
| the need  |                       | [ |                                |
| for       |                       | C |                                |
| system    |                       | l |                                |
| security  |                       | i |                                |
| awareness |                       | c |                                |
| com       |                       | k |                                |
| municated |                       | h |                                |
| to end    |                       | e |                                |
| users?    |                       | r |                                |
|           |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| What      |                       | \ |                                |
| controls  |                       | [ |                                |
| are in    |                       | C |                                |
| place to  |                       | l |                                |
| protect   |                       | i |                                |
| against   |                       | c |                                |
| impe      |                       | k |                                |
| rsonation |                       | h |                                |
| in email  |                       | e |                                |
| messages? |                       | r |                                |
| e.g.,     |                       | e |                                |
| Digital   |                       | a |                                |
| Cer       |                       | n |                                |
| tificates |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+
| \[Click   |                       | \ |                                |
| here and  |                       | [ |                                |
| Type      |                       | C |                                |
| A         |                       | l |                                |
| dditional |                       | i |                                |
| Qu        |                       | c |                                |
| estions\] |                       | k |                                |
|           |                       | h |                                |
|           |                       | e |                                |
|           |                       | r |                                |
|           |                       | e |                                |
|           |                       | a |                                |
|           |                       | n |                                |
|           |                       | d |                                |
|           |                       | T |                                |
|           |                       | y |                                |
|           |                       | p |                                |
|           |                       | e |                                |
|           |                       | R |                                |
|           |                       | e |                                |
|           |                       | s |                                |
|           |                       | p |                                |
|           |                       | o |                                |
|           |                       | n |                                |
|           |                       | s |                                |
|           |                       | e |                                |
|           |                       | \ |                                |
|           |                       | ] |                                |
+-----------+-----------------------+---+--------------------------------+

+------------+---+--------------+-----+----------------------------------+
| ##### HUMA |   |              |     |                                  |
| N THREATS  |   |              |     |                                  |
| {#human-th |   |              |     |                                  |
| reats-4 .u |   |              |     |                                  |
| nnumbered} |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| ##### TH   | # |              | #   |                                  |
| REATS {#th | # |              | ### |                                  |
| reats-3 .u | # |              | # E |                                  |
| nnumbered} | # |              | XAM |                                  |
|            | # |              | PLE |                                  |
|            |   |              | S { |                                  |
|            | D |              | #ex |                                  |
|            | E |              | amp |                                  |
|            | S |              | les |                                  |
|            | C |              | -3  |                                  |
|            | R |              | .un |                                  |
|            | I |              | num |                                  |
|            | P |              | ber |                                  |
|            | T |              | ed} |                                  |
|            | I |              |     |                                  |
|            | O |              |     |                                  |
|            | N |              |     |                                  |
|            | S |              |     |                                  |
|            |   |              |     |                                  |
|            | { |              |     |                                  |
|            | # |              |     |                                  |
|            | d |              |     |                                  |
|            | e |              |     |                                  |
|            | s |              |     |                                  |
|            | c |              |     |                                  |
|            | r |              |     |                                  |
|            | i |              |     |                                  |
|            | p |              |     |                                  |
|            | t |              |     |                                  |
|            | i |              |     |                                  |
|            | o |              |     |                                  |
|            | n |              |     |                                  |
|            | s |              |     |                                  |
|            | - |              |     |                                  |
|            | 3 |              |     |                                  |
|            |   |              |     |                                  |
|            | . |              |     |                                  |
|            | u |              |     |                                  |
|            | n |              |     |                                  |
|            | n |              |     |                                  |
|            | u |              |     |                                  |
|            | m |              |     |                                  |
|            | b |              |     |                                  |
|            | e |              |     |                                  |
|            | r |              |     |                                  |
|            | e |              |     |                                  |
|            | d |              |     |                                  |
|            | } |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| ## Should  |   | Shoulder     |     | Housekeeping staff could observe |
| er Surfing |   | Surfing is   |     | the entry of sensitive           |
|            |   | the          |     | information.                     |
| *[System   |   | deliberate   |     |                                  |
| Impact]{.u |   | attempt to   |     | Failure to protect a UserID and  |
| nderline}* |   | gain         |     | Password from observation by     |
|            |   | knowledge of |     | others during logon could allow  |
| Primarily  |   | protected    |     | unauthorized users to capture    |
| impacts    |   | information  |     | sensitive information.           |
| data       |   | from         |     |                                  |
| confid     |   | observation. |     | Visitors could capture           |
| entiality, |   | The          |     | employee's passwords and other   |
| but in     |   | unauthorized |     | sensitive information left       |
| c          |   | disclosure   |     | unprotected on desktops.         |
| ombination |   | of protected |     |                                  |
| with other |   | information  |     |                                  |
| threats    |   | leads to     |     |                                  |
| could      |   | information  |     |                                  |
| impact     |   | misuse       |     |                                  |
| integrity  |   | (identity    |     |                                  |
| and        |   | theft), or   |     |                                  |
| ava        |   | such         |     |                                  |
| ilability. |   | information  |     |                                  |
|            |   | could be     |     |                                  |
|            |   | used to gain |     |                                  |
|            |   | additional   |     |                                  |
|            |   | access or    |     |                                  |
|            |   | information. |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| **[QUES    |   |              |     | **[RESPONSES]{.underline}**      |
| TIONS]{.un |   |              |     |                                  |
| derline}** |   |              |     | **[(Each response should be      |
|            |   |              |     | entered in a Detailed Risk       |
| **[        |   |              |     | Description                      |
| Additional |   |              |     | Chart)]{.underline}**            |
| questions  |   |              |     |                                  |
| specific   |   |              |     |                                  |
| to the     |   |              |     |                                  |
| system     |   |              |     |                                  |
| under      |   |              |     |                                  |
| review may |   |              |     |                                  |
| be added   |   |              |     |                                  |
| in this    |   |              |     |                                  |
| sec        |   |              |     |                                  |
| tion.]{.un |   |              |     |                                  |
| derline}** |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| How is the |   |              |     | \[Click here and Type Response\] |
| system     |   |              |     |                                  |
| protected  |   |              |     |                                  |
| from       |   |              |     |                                  |
| takeover   |   |              |     |                                  |
| by an      |   |              |     |                                  |
| un         |   |              |     |                                  |
| authorized |   |              |     |                                  |
| person?    |   |              |     |                                  |
| e.g .is    |   |              |     |                                  |
| Session    |   |              |     |                                  |
| Timeout    |   |              |     |                                  |
| im         |   |              |     |                                  |
| plemented? |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| How are    |   |              |     | \[Click here and Type Response\] |
| users made |   |              |     |                                  |
| aware to   |   |              |     |                                  |
| protect    |   |              |     |                                  |
| their      |   |              |     |                                  |
| UserIDs    |   |              |     |                                  |
| and        |   |              |     |                                  |
| passwords? |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| How are    |   |              |     | \[Click here and Type Response\] |
| users made |   |              |     |                                  |
| aware to   |   |              |     |                                  |
| protect    |   |              |     |                                  |
| printed    |   |              |     |                                  |
| data?      |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| Is the     |   |              |     | \[Click here and Type Response\] |
| system     |   |              |     |                                  |
| protected  |   |              |     |                                  |
| with       |   |              |     |                                  |
| desktop    |   |              |     |                                  |
| locking    |   |              |     |                                  |
| mechanisms |   |              |     |                                  |
| and screen |   |              |     |                                  |
| savers?    |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+
| \[Click    |   |              |     | \[Click here and Type Response\] |
| here and   |   |              |     |                                  |
| Type       |   |              |     |                                  |
| Additional |   |              |     |                                  |
| Q          |   |              |     |                                  |
| uestions\] |   |              |     |                                  |
+------------+---+--------------+-----+----------------------------------+

+------------+---------------+-----------------------------------------+
| ##### HUMA |               |                                         |
| N THREATS  |               |                                         |
| {#human-th |               |                                         |
| reats-5 .u |               |                                         |
| nnumbered} |               |                                         |
+------------+---------------+-----------------------------------------+
| ##### TH   | ##### DES     | #                                       |
| REATS {#th | CRIPTIONS {#d | #### EXAMPLES {#examples-4 .unnumbered} |
| reats-4 .u | escriptions-4 |                                         |
| nnumbered} |  .unnumbered} |                                         |
+------------+---------------+-----------------------------------------+
| ##         | User abuse or | Users could browse systems and          |
|  User Abus | fraud         | applications in search of specific data |
| e or Fraud | addresses     | or characteristics.                     |
|            | authorized    |                                         |
| *[System   | users who     | Use of information (password) as an     |
| Impact]{.u | abuse their   | indirect aid for subsequent misuse,     |
| nderline}* | assigned      | including unauthorized access could     |
|            | access        | compromise data security.               |
| Could      | privileges or |                                         |
| sig        | rights to     | Information (Social Security numbers)   |
| nificantly | gain          | could be used as a direct aid for       |
| impact     | additional    | illegal purposes, including identity    |
| data       | information   | theft.                                  |
| confid     | or            |                                         |
| entiality, | privileges.   |                                         |
| integrity, |               |                                         |
| and        |               |                                         |
| ava        |               |                                         |
| ilability. |               |                                         |
+------------+---------------+-----------------------------------------+
| **[QUES    |               | **[RESPONSES]{.underline}**             |
| TIONS]{.un |               |                                         |
| derline}** |               | **[(Each response should be entered in  |
|            |               | a Detailed Risk Description             |
| **[        |               | Chart)]{.underline}**                   |
| Additional |               |                                         |
| questions  |               |                                         |
| specific   |               |                                         |
| to the     |               |                                         |
| system     |               |                                         |
| under      |               |                                         |
| review may |               |                                         |
| be added   |               |                                         |
| in this    |               |                                         |
| sec        |               |                                         |
| tion.]{.un |               |                                         |
| derline}** |               |                                         |
+------------+---------------+-----------------------------------------+
| How is the |               | \[Click here and Type Response\]        |
| system     |               |                                         |
| protected  |               |                                         |
| from user  |               |                                         |
| abuse or   |               |                                         |
| fraud?     |               |                                         |
+------------+---------------+-----------------------------------------+
| Do the     |               | \[Click here and Type Response\]        |
| warning    |               |                                         |
| banners    |               |                                         |
| comply     |               |                                         |
| with the   |               |                                         |
| guidance   |               |                                         |
| provided   |               |                                         |
| by the     |               |                                         |
| Department |               |                                         |
| of         |               |                                         |
| Justice?   |               |                                         |
+------------+---------------+-----------------------------------------+
| What is    |               | \[Click here and Type Response\]        |
| the user   |               |                                         |
| specific   |               |                                         |
| system     |               |                                         |
| training   |               |                                         |
| and is it  |               |                                         |
| based on   |               |                                         |
| user       |               |                                         |
| respons    |               |                                         |
| ibilities? |               |                                         |
+------------+---------------+-----------------------------------------+
| How is the |               | \[Click here and Type Response\]        |
| system     |               |                                         |
| access     |               |                                         |
| provided   |               |                                         |
| to         |               |                                         |
| c          |               |                                         |
| ontractors |               |                                         |
| regulated  |               |                                         |
| and what   |               |                                         |
| are the    |               |                                         |
| security   |               |                                         |
| re         |               |                                         |
| quirements |               |                                         |
| for        |               |                                         |
| co         |               |                                         |
| ntractors? |               |                                         |
+------------+---------------+-----------------------------------------+
| What are   |               | \[Click here and Type Response\]        |
| the        |               |                                         |
| personnel  |               |                                         |
| security   |               |                                         |
| controls   |               |                                         |
| in place   |               |                                         |
| for the    |               |                                         |
| system to  |               |                                         |
| prevent    |               |                                         |
| user       |               |                                         |
| abuse?     |               |                                         |
+------------+---------------+-----------------------------------------+
| \[Click    |               | \[Click here and Type Response\]        |
| here and   |               |                                         |
| Type       |               |                                         |
| Additional |               |                                         |
| Q          |               |                                         |
| uestions\] |               |                                         |
+------------+---------------+-----------------------------------------+

+-------------+---------------+-----------------------------------------+
| #####       |               |                                         |
| HUMAN THREA |               |                                         |
| TS {#human- |               |                                         |
| threats-6 . |               |                                         |
| unnumbered} |               |                                         |
+-------------+---------------+-----------------------------------------+
| #####       | ##### DES     | #                                       |
|  THREATS {# | CRIPTIONS {#d | #### EXAMPLES {#examples-5 .unnumbered} |
| threats-5 . | escriptions-5 |                                         |
| unnumbered} |  .unnumbered} |                                         |
+-------------+---------------+-----------------------------------------+
| ## Theft,   | Theft,        | Disgruntled employees could create both |
|  Sabotage,  | sabotage,     | mischief and sabotage of system data.   |
| Vandalism,  | vandalism, or |                                         |
| or Physical | physical      | Deletion or corruption of data could    |
|  Intrusions | intrusions    | occur through acts of vandalism.        |
|             | are           |                                         |
| *[System    | deliberate    | Logic bombs could destroy system data   |
| Impact]{.   | malicious     | at a given time or under certain        |
| underline}* | acts that     | circumstances.                          |
|             | could cause   |                                         |
| Could       | damage,       | Sensitive data could be captured        |
| si          | destruction,  | through application vulnerabilities,    |
| gnificantly | or loss of    | and held hostage.                       |
| impact data | system        |                                         |
| integrity   | assets. Such  | Cleaning staffs/vendors could have      |
| and         | an act could  | access to sensitive information.        |
| av          | also enable   |                                         |
| ailability, | other         |                                         |
| and to a    | threats, such |                                         |
| lesser      | as compromise |                                         |
| extent data | of            |                                         |
| conf        | i             |                                         |
| identiality | nterconnected |                                         |
|             | systems.      |                                         |
+-------------+---------------+-----------------------------------------+
| **[QU       |               | **[RESPONSES]{.underline}**             |
| ESTIONS]{.u |               |                                         |
| nderline}** |               | **[(Each response should be entered in  |
|             |               | a Detailed Risk Description             |
| **          |               | Chart)]{.underline}**                   |
| [Additional |               |                                         |
| questions   |               |                                         |
| specific to |               |                                         |
| the system  |               |                                         |
| under       |               |                                         |
| review may  |               |                                         |
| be added in |               |                                         |
| this        |               |                                         |
| s           |               |                                         |
| ection.]{.u |               |                                         |
| nderline}** |               |                                         |
+-------------+---------------+-----------------------------------------+
| How is      |               | \[Click here and Type Response\]        |
| system      |               |                                         |
| protected   |               |                                         |
| from        |               |                                         |
| sabotage?   |               |                                         |
+-------------+---------------+-----------------------------------------+
| How is data |               | \[Click here and Type Response\]        |
| in the      |               |                                         |
| system      |               |                                         |
| protected   |               |                                         |
| from being  |               |                                         |
| destroyed?  |               |                                         |
+-------------+---------------+-----------------------------------------+
| How         |               | \[Click here and Type Response\]        |
| frequently  |               |                                         |
| is data     |               |                                         |
| backed up?  |               |                                         |
+-------------+---------------+-----------------------------------------+
| Is there a  |               | \[Click here and Type Response\]        |
| disaster    |               |                                         |
| recovery or |               |                                         |
| business    |               |                                         |
| continuity  |               |                                         |
| plan in     |               |                                         |
| place in    |               |                                         |
| case of     |               |                                         |
| system      |               |                                         |
| unav        |               |                                         |
| ailability? |               |                                         |
+-------------+---------------+-----------------------------------------+
| Are         |               | \[Click here and Type Response\]        |
| employees,  |               |                                         |
| cleaning    |               |                                         |
| staff, and  |               |                                         |
| vendors     |               |                                         |
| subject to  |               |                                         |
| background  |               |                                         |
| screenings? |               |                                         |
+-------------+---------------+-----------------------------------------+
| \[Click     |               | \[Click here and Type Response\]        |
| here and    |               |                                         |
| Type        |               |                                         |
| Additional  |               |                                         |
| Questions\] |               |                                         |
+-------------+---------------+-----------------------------------------+

+-----------+--------------+-------------------------------------------+
| #####     |              |                                           |
|  HUMAN TH |              |                                           |
| REATS {#h |              |                                           |
| uman-thre |              |                                           |
| ats-7 .un |              |                                           |
| numbered} |              |                                           |
+-----------+--------------+-------------------------------------------+
| ##        | ##### DESCRI | ##### EXAMPLES {#examples-6 .unnumbered}  |
| ### THREA | PTIONS {#des |                                           |
| TS {#thre | criptions-6  |                                           |
| ats-6 .un | .unnumbered} |                                           |
| numbered} |              |                                           |
+-----------+--------------+-------------------------------------------+
| ##        | Espionage is | Espionage could be conducted by foreign   |
| Espionage | the covert   | governments through technical means, such |
|           | act of       | as electronic bugs and wire taps.         |
| *[System  | spying       |                                           |
| Im        | through      | Foreign governments could recruit an      |
| pact]{.un | copying,     | agent inside the target agency by either  |
| derline}* | reproducing, | bribing or blackmailing an employee.      |
|           | recording,   |                                           |
| Sign      | ph           | Medical companies could encourage         |
| ificantly | otographing, | employees to take positions in CMS to     |
| impacts   | i            | provide them with a constant supply of    |
| data      | nterception, | information.                              |
| confide   | etc., to     |                                           |
| ntiality, | obtain       | The use of legitimate business            |
| but       | information. | agreements, such as licensing and on-site |
| combined  |              | liaison officers or contractors, could be |
| with      |              | used to provide unauthorized              |
| other     |              | opportunities to gather information.      |
| threats   |              |                                           |
| could     |              |                                           |
| impact    |              |                                           |
| data      |              |                                           |
| integrity |              |                                           |
| and       |              |                                           |
| avai      |              |                                           |
| lability. |              |                                           |
+-----------+--------------+-------------------------------------------+
| **[QUESTI |              | **[RESPONSES]{.underline}**               |
| ONS]{.und |              |                                           |
| erline}** |              | **[(Each response should be entered in a  |
|           |              | Detailed Risk Description                 |
| **[A      |              | Chart)]{.underline}**                     |
| dditional |              |                                           |
| questions |              |                                           |
| specific  |              |                                           |
| to the    |              |                                           |
| system    |              |                                           |
| under     |              |                                           |
| review    |              |                                           |
| may be    |              |                                           |
| added in  |              |                                           |
| this      |              |                                           |
| secti     |              |                                           |
| on.]{.und |              |                                           |
| erline}** |              |                                           |
+-----------+--------------+-------------------------------------------+
| How is    |              | \[Click here and Type Response\]          |
| data      |              |                                           |
| protected |              |                                           |
| from      |              |                                           |
| e         |              |                                           |
| spionage? |              |                                           |
+-----------+--------------+-------------------------------------------+
| Are       |              | \[Click here and Type Response\]          |
| b         |              |                                           |
| ackground |              |                                           |
| checks    |              |                                           |
| performed |              |                                           |
| on staff  |              |                                           |
| who have  |              |                                           |
| access to |              |                                           |
| the       |              |                                           |
| system?   |              |                                           |
+-----------+--------------+-------------------------------------------+
| Are there |              | \[Click here and Type Response\]          |
| any       |              |                                           |
| business  |              |                                           |
| a         |              |                                           |
| greements |              |                                           |
| with      |              |                                           |
| on-site   |              |                                           |
| co        |              |                                           |
| ntractors |              |                                           |
| or        |              |                                           |
| liaison   |              |                                           |
| officers? |              |                                           |
+-----------+--------------+-------------------------------------------+
| Are       |              | \[Click here and Type Response\]          |
| b         |              |                                           |
| ackground |              |                                           |
| checks    |              |                                           |
| performed |              |                                           |
| on        |              |                                           |
| con       |              |                                           |
| tractors? |              |                                           |
+-----------+--------------+-------------------------------------------+
| How are   |              | \[Click here and Type Response\]          |
| co        |              |                                           |
| ntractors |              |                                           |
| informed  |              |                                           |
| of the    |              |                                           |
| i         |              |                                           |
| mportance |              |                                           |
| of system |              |                                           |
| security? |              |                                           |
+-----------+--------------+-------------------------------------------+
| \[Click   |              | \[Click here and Type Response\]          |
| here and  |              |                                           |
| Type      |              |                                           |
| A         |              |                                           |
| dditional |              |                                           |
| Qu        |              |                                           |
| estions\] |              |                                           |
+-----------+--------------+-------------------------------------------+

+-----------+--------------+-------------------------------------------+
| #####     |              |                                           |
|  HUMAN TH |              |                                           |
| REATS {#h |              |                                           |
| uman-thre |              |                                           |
| ats-8 .un |              |                                           |
| numbered} |              |                                           |
+-----------+--------------+-------------------------------------------+
| ##        | ##### DESCRI | ##### EXAMPLES {#examples-7 .unnumbered}  |
| ### THREA | PTIONS {#des |                                           |
| TS {#thre | criptions-7  |                                           |
| ats-7 .un | .unnumbered} |                                           |
| numbered} |              |                                           |
+-----------+--------------+-------------------------------------------+
| ## Othe   | (To be       |                                           |
| r Threats | specified by |                                           |
|           | system owner |                                           |
|           | or           |                                           |
|           | developer.)  |                                           |
+-----------+--------------+-------------------------------------------+
| **[QUESTI |              | **[RESPONSES]{.underline}**               |
| ONS]{.und |              |                                           |
| erline}** |              | **[(Each response should be entered in a  |
|           |              | Detailed Risk Description                 |
| **[A      |              | Chart)]{.underline}**                     |
| dditional |              |                                           |
| questions |              |                                           |
| specific  |              |                                           |
| to the    |              |                                           |
| system    |              |                                           |
| under     |              |                                           |
| review    |              |                                           |
| may be    |              |                                           |
| added in  |              |                                           |
| this      |              |                                           |
| secti     |              |                                           |
| on.]{.und |              |                                           |
| erline}** |              |                                           |
+-----------+--------------+-------------------------------------------+
| \[Click   |              | \[Click here and Type Response\]          |
| here and  |              |                                           |
| Type      |              |                                           |
| A         |              |                                           |
| dditional |              |                                           |
| Qu        |              |                                           |
| estions\] |              |                                           |
+-----------+--------------+-------------------------------------------+
| \[Click   |              | \[Click here and Type Response\]          |
| here and  |              |                                           |
| Type      |              |                                           |
| A         |              |                                           |
| dditional |              |                                           |
| Qu        |              |                                           |
| estions\] |              |                                           |
+-----------+--------------+-------------------------------------------+

# TECHNICAL THREATS

+-------------+---+------------+---+---------------------------------------+
| ###         |   |            |   |                                       |
| ## TECHNICA |   |            |   |                                       |
| L THREATS { |   |            |   |                                       |
| #technical- |   |            |   |                                       |
| threats-1 . |   |            |   |                                       |
| unnumbered} |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| #####       | # |            | # |                                       |
|  THREATS {# | # |            | # |                                       |
| threats-8 . | # |            | # |                                       |
| unnumbered} | # |            | # |                                       |
|             | # |            | # |                                       |
|             |   |            |   |                                       |
|             | D |            | E |                                       |
|             | E |            | X |                                       |
|             | S |            | A |                                       |
|             | C |            | M |                                       |
|             | R |            | P |                                       |
|             | I |            | L |                                       |
|             | P |            | E |                                       |
|             | T |            | S |                                       |
|             | I |            |   |                                       |
|             | O |            | { |                                       |
|             | N |            | # |                                       |
|             | S |            | e |                                       |
|             |   |            | x |                                       |
|             | { |            | a |                                       |
|             | # |            | m |                                       |
|             | d |            | p |                                       |
|             | e |            | l |                                       |
|             | s |            | e |                                       |
|             | c |            | s |                                       |
|             | r |            | - |                                       |
|             | i |            | 8 |                                       |
|             | p |            |   |                                       |
|             | t |            | . |                                       |
|             | i |            | u |                                       |
|             | o |            | n |                                       |
|             | n |            | n |                                       |
|             | s |            | u |                                       |
|             | - |            | m |                                       |
|             | 8 |            | b |                                       |
|             |   |            | e |                                       |
|             | . |            | r |                                       |
|             | u |            | e |                                       |
|             | n |            | d |                                       |
|             | n |            | } |                                       |
|             | u |            |   |                                       |
|             | m |            |   |                                       |
|             | b |            |   |                                       |
|             | e |            |   |                                       |
|             | r |            |   |                                       |
|             | e |            |   |                                       |
|             | d |            |   |                                       |
|             | } |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| ## Misrepr  | M |            | > |                                       |
| esentation  | i |            |   |                                       |
| of Identity | s |            | A |                                       |
|             | r |            | b |                                       |
| *[System    | e |            | u |                                       |
| Impact]{.   | p |            | s |                                       |
| underline}* | r |            | e |                                       |
|             | e |            | > |                                       |
| Could       | s |            |   |                                       |
| si          | e |            | o |                                       |
| gnificantly | n |            | f |                                       |
| impact data | t |            | > |                                       |
| confi       | a |            |   |                                       |
| dentiality, | t |            | p |                                       |
| and to a    | i |            | r |                                       |
| lesser      | o |            | i |                                       |
| extent,     | n |            | v |                                       |
| data        | s |            | i |                                       |
| integrity   | o |            | l |                                       |
| and         | f |            | e |                                       |
| av          | i |            | g |                                       |
| ailability. | d |            | e |                                       |
|             | e |            | s |                                       |
|             | n |            | > |                                       |
|             | t |            |   |                                       |
|             | i |            | s |                                       |
|             | t |            | u |                                       |
|             | y |            | c |                                       |
|             | a |            | h |                                       |
|             | r |            | > |                                       |
|             | e |            |   |                                       |
|             | t |            | a |                                       |
|             | h |            | s |                                       |
|             | r |            | > |                                       |
|             | e |            |   |                                       |
|             | a |            | m |                                       |
|             | t |            | i |                                       |
|             | s |            | s |                                       |
|             | t |            | u |                                       |
|             | h |            | s |                                       |
|             | a |            | e |                                       |
|             | t |            | > |                                       |
|             | o |            |   |                                       |
|             | f |            | o |                                       |
|             | t |            | f |                                       |
|             | e |            | > |                                       |
|             | n |            |   |                                       |
|             | b |            | U |                                       |
|             | e |            | S |                                       |
|             | c |            | E |                                       |
|             | o |            | R |                                       |
|             | m |            | I |                                       |
|             | e |            | D |                                       |
|             | e |            | s |                                       |
|             | n |            | > |                                       |
|             | a |            |   |                                       |
|             | b |            | a |                                       |
|             | l |            | n |                                       |
|             | e |            | d |                                       |
|             | r |            | > |                                       |
|             | s |            |   |                                       |
|             | f |            | p |                                       |
|             | o |            | a |                                       |
|             | r |            | s |                                       |
|             | o |            | s |                                       |
|             | t |            | w |                                       |
|             | h |            | o |                                       |
|             | e |            | r |                                       |
|             | r |            | d |                                       |
|             | t |            | s |                                       |
|             | h |            | > |                                       |
|             | r |            |   |                                       |
|             | e |            | c |                                       |
|             | a |            | o |                                       |
|             | t |            | u |                                       |
|             | s |            | l |                                       |
|             | . |            | d |                                       |
|             | M |            | > |                                       |
|             | i |            |   |                                       |
|             | s |            | b |                                       |
|             | r |            | e |                                       |
|             | e |            | > |                                       |
|             | p |            |   |                                       |
|             | r |            | u |                                       |
|             | e |            | s |                                       |
|             | s |            | e |                                       |
|             | e |            | d |                                       |
|             | n |            | > |                                       |
|             | t |            |   |                                       |
|             | a |            | t |                                       |
|             | t |            | o |                                       |
|             | i |            | > |                                       |
|             | o |            |   |                                       |
|             | n |            | g |                                       |
|             | f |            | a |                                       |
|             | o |            | i |                                       |
|             | r |            | n |                                       |
|             | e |            | > |                                       |
|             | l |            |   |                                       |
|             | e |            | u |                                       |
|             | c |            | n |                                       |
|             | t |            | a |                                       |
|             | r |            | u |                                       |
|             | o |            | t |                                       |
|             | n |            | h |                                       |
|             | i |            | o |                                       |
|             | c |            | r |                                       |
|             | o |            | i |                                       |
|             | r |            | z |                                       |
|             | s |            | e |                                       |
|             | y |            | d |                                       |
|             | s |            | > |                                       |
|             | t |            |   |                                       |
|             | e |            | a |                                       |
|             | m |            | c |                                       |
|             | a |            | c |                                       |
|             | c |            | e |                                       |
|             | c |            | s |                                       |
|             | e |            | s |                                       |
|             | s |            | > |                                       |
|             | s |            |   |                                       |
|             | c |            | t |                                       |
|             | o |            | o |                                       |
|             | u |            | > |                                       |
|             | l |            |   |                                       |
|             | d |            | s |                                       |
|             | i |            | e |                                       |
|             | n |            | n |                                       |
|             | c |            | s |                                       |
|             | l |            | i |                                       |
|             | u |            | t |                                       |
|             | d |            | i |                                       |
|             | e |            | v |                                       |
|             | u |            | e |                                       |
|             | s |            | > |                                       |
|             | e |            |   |                                       |
|             | o |            | d |                                       |
|             | f |            | a |                                       |
|             | o |            | t |                                       |
|             | t |            | a |                                       |
|             | h |            | . |                                       |
|             | e |            | > |                                       |
|             | r |            | > |                                       |
|             | s |            |   |                                       |
|             | ' |            | P |                                       |
|             | i |            | e |                                       |
|             | d |            | r |                                       |
|             | e |            | s |                                       |
|             | n |            | o |                                       |
|             | t |            | n |                                       |
|             | i |            | a |                                       |
|             | f |            | l |                                       |
|             | i |            | > |                                       |
|             | c |            |   |                                       |
|             | a |            | p |                                       |
|             | t |            | r |                                       |
|             | i |            | o |                                       |
|             | o |            | f |                                       |
|             | n |            | i |                                       |
|             | a |            | l |                                       |
|             | n |            | e |                                       |
|             | d |            | > |                                       |
|             | a |            |   |                                       |
|             | u |            | e |                                       |
|             | t |            | x |                                       |
|             | h |            | t |                                       |
|             | e |            | r |                                       |
|             | n |            | a |                                       |
|             | t |            | c |                                       |
|             | i |            | t |                                       |
|             | c |            | i |                                       |
|             | a |            | o |                                       |
|             | t |            | n |                                       |
|             | i |            | > |                                       |
|             | o |            |   |                                       |
|             | n |            | c |                                       |
|             | i |            | o |                                       |
|             | n |            | u |                                       |
|             | f |            | l |                                       |
|             | o |            | d |                                       |
|             | r |            | > |                                       |
|             | m |            |   |                                       |
|             | a |            | a |                                       |
|             | t |            | l |                                       |
|             | i |            | l |                                       |
|             | o |            | o |                                       |
|             | n |            | w |                                       |
|             | i |            | > |                                       |
|             | n |            |   |                                       |
|             | a |            | a |                                       |
|             | n |            | n |                                       |
|             | a |            | > |                                       |
|             | t |            |   |                                       |
|             | t |            | u |                                       |
|             | e |            | n |                                       |
|             | m |            | a |                                       |
|             | p |            | u |                                       |
|             | t |            | t |                                       |
|             | t |            | h |                                       |
|             | o |            | o |                                       |
|             | g |            | r |                                       |
|             | a |            | i |                                       |
|             | i |            | z |                                       |
|             | n |            | e |                                       |
|             | p |            | d |                                       |
|             | r |            | > |                                       |
|             | i |            |   |                                       |
|             | v |            | p |                                       |
|             | i |            | e |                                       |
|             | l |            | r |                                       |
|             | e |            | s |                                       |
|             | g |            | o |                                       |
|             | e |            | n |                                       |
|             | s |            | > |                                       |
|             | i |            |   |                                       |
|             | n |            | t |                                       |
|             | t |            | o |                                       |
|             | o |            | > |                                       |
|             | s |            |   |                                       |
|             | y |            | a |                                       |
|             | s |            | s |                                       |
|             | t |            | s |                                       |
|             | e |            | u |                                       |
|             | m |            | m |                                       |
|             | r |            | e |                                       |
|             | e |            | > |                                       |
|             | s |            |   |                                       |
|             | o |            | a |                                       |
|             | u |            | n |                                       |
|             | r |            | > |                                       |
|             | c |            |   |                                       |
|             | e |            | o |                                       |
|             | s |            | t |                                       |
|             | . |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | w |                                       |
|             |   |            | i |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | u |                                       |
|             |   |            | t |                                       |
|             |   |            | h |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | i |                                       |
|             |   |            | z |                                       |
|             |   |            | e |                                       |
|             |   |            | d |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | r |                                       |
|             |   |            | o |                                       |
|             |   |            | l |                                       |
|             |   |            | e |                                       |
|             |   |            | . |                                       |
|             |   |            | > |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | F |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | g |                                       |
|             |   |            | e |                                       |
|             |   |            | d |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | d |                                       |
|             |   |            | o |                                       |
|             |   |            | c |                                       |
|             |   |            | u |                                       |
|             |   |            | m |                                       |
|             |   |            | e |                                       |
|             |   |            | n |                                       |
|             |   |            | t |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | m |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | s |                                       |
|             |   |            | a |                                       |
|             |   |            | g |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | c |                                       |
|             |   |            | o |                                       |
|             |   |            | u |                                       |
|             |   |            | l |                                       |
|             |   |            | d |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | f |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | m |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | t |                                       |
|             |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | b |                                       |
|             |   |            | a |                                       |
|             |   |            | s |                                       |
|             |   |            | i |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | f |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | c |                                       |
|             |   |            | o |                                       |
|             |   |            | s |                                       |
|             |   |            | t |                                       |
|             |   |            | l |                                       |
|             |   |            | y |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | b |                                       |
|             |   |            | u |                                       |
|             |   |            | s |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | d |                                       |
|             |   |            | e |                                       |
|             |   |            | c |                                       |
|             |   |            | i |                                       |
|             |   |            | s |                                       |
|             |   |            | i |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | . |                                       |
|             |   |            | > |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | S |                                       |
|             |   |            | o |                                       |
|             |   |            | c |                                       |
|             |   |            | i |                                       |
|             |   |            | a |                                       |
|             |   |            | l |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | e |                                       |
|             |   |            | n |                                       |
|             |   |            | g |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | e |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | g |                                       |
|             |   |            | , |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | s |                                       |
|             |   |            | u |                                       |
|             |   |            | c |                                       |
|             |   |            | h |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | t |                                       |
|             |   |            | r |                                       |
|             |   |            | i |                                       |
|             |   |            | c |                                       |
|             |   |            | k |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | g |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | e |                                       |
|             |   |            | m |                                       |
|             |   |            | p |                                       |
|             |   |            | l |                                       |
|             |   |            | o |                                       |
|             |   |            | y |                                       |
|             |   |            | e |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | t |                                       |
|             |   |            | o |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | v |                                       |
|             |   |            | e |                                       |
|             |   |            | a |                                       |
|             |   |            | l |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | g |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | p |                                       |
|             |   |            | a |                                       |
|             |   |            | s |                                       |
|             |   |            | s |                                       |
|             |   |            | w |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | d |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | o |                                       |
|             |   |            | t |                                       |
|             |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | f |                                       |
|             |   |            | o |                                       |
|             |   |            | r |                                       |
|             |   |            | m |                                       |
|             |   |            | a |                                       |
|             |   |            | t |                                       |
|             |   |            | i |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | t |                                       |
|             |   |            | h |                                       |
|             |   |            | a |                                       |
|             |   |            | t |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | p |                                       |
|             |   |            | r |                                       |
|             |   |            | o |                                       |
|             |   |            | v |                                       |
|             |   |            | i |                                       |
|             |   |            | d |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | c |                                       |
|             |   |            | c |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | s |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | t |                                       |
|             |   |            | o |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | a |                                       |
|             |   |            | p |                                       |
|             |   |            | p |                                       |
|             |   |            | l |                                       |
|             |   |            | i |                                       |
|             |   |            | c |                                       |
|             |   |            | a |                                       |
|             |   |            | t |                                       |
|             |   |            | i |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | c |                                       |
|             |   |            | o |                                       |
|             |   |            | u |                                       |
|             |   |            | l |                                       |
|             |   |            | d |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | c |                                       |
|             |   |            | o |                                       |
|             |   |            | m |                                       |
|             |   |            | p |                                       |
|             |   |            | r |                                       |
|             |   |            | o |                                       |
|             |   |            | m |                                       |
|             |   |            | i |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | d |                                       |
|             |   |            | a |                                       |
|             |   |            | t |                                       |
|             |   |            | a |                                       |
|             |   |            | > |                                       |
|             |   |            |   |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | c |                                       |
|             |   |            | u |                                       |
|             |   |            | r |                                       |
|             |   |            | i |                                       |
|             |   |            | t |                                       |
|             |   |            | y |                                       |
+-------------+---+------------+---+---------------------------------------+
| **[QU       |   |            | * |                                       |
| ESTIONS]{.u |   |            | * |                                       |
| nderline}** |   |            | [ |                                       |
|             |   |            | R |                                       |
| **          |   |            | E |                                       |
| [Additional |   |            | S |                                       |
| questions   |   |            | P |                                       |
| specific to |   |            | O |                                       |
| the system  |   |            | N |                                       |
| under       |   |            | S |                                       |
| review may  |   |            | E |                                       |
| be added in |   |            | S |                                       |
| this        |   |            | ] |                                       |
| s           |   |            | { |                                       |
| ection.]{.u |   |            | . |                                       |
| nderline}** |   |            | u |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | l |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | e |                                       |
|             |   |            | } |                                       |
|             |   |            | * |                                       |
|             |   |            | * |                                       |
|             |   |            |   |                                       |
|             |   |            | * |                                       |
|             |   |            | * |                                       |
|             |   |            | [ |                                       |
|             |   |            | ( |                                       |
|             |   |            | E |                                       |
|             |   |            | a |                                       |
|             |   |            | c |                                       |
|             |   |            | h |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | h |                                       |
|             |   |            | o |                                       |
|             |   |            | u |                                       |
|             |   |            | l |                                       |
|             |   |            | d |                                       |
|             |   |            | b |                                       |
|             |   |            | e |                                       |
|             |   |            | e |                                       |
|             |   |            | n |                                       |
|             |   |            | t |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | d |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | a |                                       |
|             |   |            | D |                                       |
|             |   |            | e |                                       |
|             |   |            | t |                                       |
|             |   |            | a |                                       |
|             |   |            | i |                                       |
|             |   |            | l |                                       |
|             |   |            | e |                                       |
|             |   |            | d |                                       |
|             |   |            | R |                                       |
|             |   |            | i |                                       |
|             |   |            | s |                                       |
|             |   |            | k |                                       |
|             |   |            | D |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | c |                                       |
|             |   |            | r |                                       |
|             |   |            | i |                                       |
|             |   |            | p |                                       |
|             |   |            | t |                                       |
|             |   |            | i |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | C |                                       |
|             |   |            | h |                                       |
|             |   |            | a |                                       |
|             |   |            | r |                                       |
|             |   |            | t |                                       |
|             |   |            | ) |                                       |
|             |   |            | ] |                                       |
|             |   |            | { |                                       |
|             |   |            | . |                                       |
|             |   |            | u |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | l |                                       |
|             |   |            | i |                                       |
|             |   |            | n |                                       |
|             |   |            | e |                                       |
|             |   |            | } |                                       |
|             |   |            | * |                                       |
|             |   |            | * |                                       |
+-------------+---+------------+---+---------------------------------------+
| Are there   |   |            | \ |                                       |
| any         |   |            | [ |                                       |
| procedures  |   |            | C |                                       |
| in place to |   |            | l |                                       |
| protect the |   |            | i |                                       |
| system from |   |            | c |                                       |
| u           |   |            | k |                                       |
| nauthorized |   |            | h |                                       |
| use? e.g.,  |   |            | e |                                       |
| Iden        |   |            | r |                                       |
| tification, |   |            | e |                                       |
| Aut         |   |            | a |                                       |
| hentication |   |            | n |                                       |
| and         |   |            | d |                                       |
| Au          |   |            | T |                                       |
| thorization |   |            | y |                                       |
| of users.   |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| What are    |   |            | \ |                                       |
| the         |   |            | [ |                                       |
| controls in |   |            | C |                                       |
| place to    |   |            | l |                                       |
| prevent the |   |            | i |                                       |
| abuse of    |   |            | c |                                       |
| privileges? |   |            | k |                                       |
|             |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | T |                                       |
|             |   |            | y |                                       |
|             |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| How is the  |   |            | \ |                                       |
| system      |   |            | [ |                                       |
| protected   |   |            | C |                                       |
| from        |   |            | l |                                       |
| u           |   |            | i |                                       |
| nauthorized |   |            | c |                                       |
| physical    |   |            | k |                                       |
| access?     |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | T |                                       |
|             |   |            | y |                                       |
|             |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| > What      |   |            | \ |                                       |
| > controls  |   |            | [ |                                       |
| > are in    |   |            | C |                                       |
| > place to  |   |            | l |                                       |
| > check     |   |            | i |                                       |
| > that data |   |            | c |                                       |
| > conf      |   |            | k |                                       |
| identiality |   |            | h |                                       |
| > is        |   |            | e |                                       |
| >           |   |            | r |                                       |
| maintained? |   |            | e |                                       |
| > E.g.,     |   |            | a |                                       |
| > technical |   |            | n |                                       |
| > approach, |   |            | d |                                       |
| > in        |   |            | T |                                       |
| stitutional |   |            | y |                                       |
| > policies  |   |            | p |                                       |
| > and       |   |            | e |                                       |
| >           |   |            | R |                                       |
| procedures, |   |            | e |                                       |
| > training, |   |            | s |                                       |
| > legal and |   |            | p |                                       |
| >           |   |            | o |                                       |
|  regulatory |   |            | n |                                       |
| > re        |   |            | s |                                       |
| quirements. |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| How are     |   |            | \ |                                       |
| users       |   |            | [ |                                       |
| informed of |   |            | C |                                       |
| the         |   |            | l |                                       |
| importance  |   |            | i |                                       |
| of          |   |            | c |                                       |
| conf        |   |            | k |                                       |
| identiality |   |            | h |                                       |
| to prevent  |   |            | e |                                       |
| the         |   |            | r |                                       |
| compromise  |   |            | e |                                       |
| of system   |   |            | a |                                       |
| security?   |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | T |                                       |
|             |   |            | y |                                       |
|             |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| How are     |   |            | \ |                                       |
| users       |   |            | [ |                                       |
| trained to  |   |            | C |                                       |
| resist      |   |            | l |                                       |
| social      |   |            | i |                                       |
| e           |   |            | c |                                       |
| ngineering? |   |            | k |                                       |
|             |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | T |                                       |
|             |   |            | y |                                       |
|             |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| \[Click     |   |            | \ |                                       |
| here and    |   |            | [ |                                       |
| Type        |   |            | C |                                       |
| Additional  |   |            | l |                                       |
| Questions\] |   |            | i |                                       |
|             |   |            | c |                                       |
|             |   |            | k |                                       |
|             |   |            | h |                                       |
|             |   |            | e |                                       |
|             |   |            | r |                                       |
|             |   |            | e |                                       |
|             |   |            | a |                                       |
|             |   |            | n |                                       |
|             |   |            | d |                                       |
|             |   |            | T |                                       |
|             |   |            | y |                                       |
|             |   |            | p |                                       |
|             |   |            | e |                                       |
|             |   |            | R |                                       |
|             |   |            | e |                                       |
|             |   |            | s |                                       |
|             |   |            | p |                                       |
|             |   |            | o |                                       |
|             |   |            | n |                                       |
|             |   |            | s |                                       |
|             |   |            | e |                                       |
|             |   |            | \ |                                       |
|             |   |            | ] |                                       |
+-------------+---+------------+---+---------------------------------------+
| ###         |   |            |   |                                       |
| ## TECHNICA |   |            |   |                                       |
| L THREATS { |   |            |   |                                       |
| #technical- |   |            |   |                                       |
| threats-2 . |   |            |   |                                       |
| unnumbered} |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| #####       |   | ##### DE   |   | ###                                   |
|  THREATS {# |   | SCRIPTIONS |   | ## EXAMPLES {#examples-9 .unnumbered} |
| threats-9 . |   |  {#descrip |   |                                       |
| unnumbered} |   | tions-9 .u |   |                                       |
|             |   | nnumbered} |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| ## Intrusio |   | Gaining    |   | Trojan Horses perform malicious       |
| n or Unauth |   | un         |   | system actions in a hidden manner,    |
| orized Acce |   | authorized |   | including file modification,          |
| ss to Syste |   | access to  |   | deletion, copying, or the             |
| m Resources |   | system     |   | installation of system backdoors.     |
|             |   | resources. |   | Some examples are SubSeven, Trojan,   |
| *[System    |   | The intent |   | NetBus, BackOrifice, and Deep Throat. |
| Impact]{.   |   | could be   |   |                                       |
| underline}* |   | malicious  |   | Trap Door (back door) attacks could   |
|             |   | or         |   | result in improper identification and |
| Could       |   | non        |   | authentication, improper              |
| si          |   | -malicious |   | initialization or allocation,         |
| gnificantly |   | (e.g.,     |   | improper runtime validation or        |
| impact data |   | curiosity  |   | improper encapsulation                |
| confi       |   | seeker) in |   |                                       |
| dentiality, |   | nature.    |   |                                       |
| integrity,  |   |            |   |                                       |
| and         |   |            |   |                                       |
| av          |   |            |   |                                       |
| ailability. |   |            |   |                                       |
|             |   |            |   |                                       |
| ##          |   |            |   |                                       |
| {#section . |   |            |   |                                       |
| unnumbered} |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| **[QU       |   |            |   | **[RESPONSES]{.underline}**           |
| ESTIONS]{.u |   |            |   |                                       |
| nderline}** |   |            |   | **[(Each response should be entered   |
|             |   |            |   | in a Detailed Risk Description        |
| **          |   |            |   | Chart)]{.underline}**                 |
| [Additional |   |            |   |                                       |
| questions   |   |            |   |                                       |
| specific to |   |            |   |                                       |
| the system  |   |            |   |                                       |
| under       |   |            |   |                                       |
| review may  |   |            |   |                                       |
| be added in |   |            |   |                                       |
| this        |   |            |   |                                       |
| s           |   |            |   |                                       |
| ection.]{.u |   |            |   |                                       |
| nderline}** |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| What are    |   |            |   | \[Click here and Type Response\]      |
| the         |   |            |   |                                       |
| protective  |   |            |   |                                       |
| measures in |   |            |   |                                       |
| place to    |   |            |   |                                       |
| control the |   |            |   |                                       |
| system?     |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| Are there   |   |            |   | \[Click here and Type Response\]      |
| virus       |   |            |   |                                       |
| scanning    |   |            |   |                                       |
| solutions   |   |            |   |                                       |
| protecting  |   |            |   |                                       |
| the system? |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| How is the  |   |            |   | \[Click here and Type Response\]      |
| system      |   |            |   |                                       |
| protected   |   |            |   |                                       |
| from the    |   |            |   |                                       |
| i           |   |            |   |                                       |
| nstallation |   |            |   |                                       |
| of Trojan   |   |            |   |                                       |
| Horses?     |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| Are there   |   |            |   | \[Click here and Type Response\]      |
| any         |   |            |   |                                       |
| Intrusion   |   |            |   |                                       |
| Detection   |   |            |   |                                       |
| Systems to  |   |            |   |                                       |
| monitor the |   |            |   |                                       |
| net         |   |            |   |                                       |
| work/system |   |            |   |                                       |
| to detect   |   |            |   |                                       |
| misuse and  |   |            |   |                                       |
| anomaly     |   |            |   |                                       |
| activities? |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| What are    |   |            |   | \[Click here and Type Response\]      |
| the other   |   |            |   |                                       |
| controls in |   |            |   |                                       |
| place to    |   |            |   |                                       |
| monitor     |   |            |   |                                       |
| network     |   |            |   |                                       |
| traffic for |   |            |   |                                       |
| unexpected  |   |            |   |                                       |
| behavior?   |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| Are system  |   |            |   | \[Click here and Type Response\]      |
| logs        |   |            |   |                                       |
| reviewed    |   |            |   |                                       |
| for         |   |            |   |                                       |
| ini         |   |            |   |                                       |
| tialization |   |            |   |                                       |
| sequences,  |   |            |   |                                       |
| logons and  |   |            |   |                                       |
| errors;     |   |            |   |                                       |
| system      |   |            |   |                                       |
| processes   |   |            |   |                                       |
| and         |   |            |   |                                       |
| p           |   |            |   |                                       |
| erformance; |   |            |   |                                       |
| and system  |   |            |   |                                       |
| resources   |   |            |   |                                       |
| utilization |   |            |   |                                       |
| to          |   |            |   |                                       |
| determine   |   |            |   |                                       |
| unexpected  |   |            |   |                                       |
| behavior?   |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| Are         |   |            |   | \[Click here and Type Response\]      |
| critical    |   |            |   |                                       |
| files and   |   |            |   |                                       |
| directories |   |            |   |                                       |
| reviewed    |   |            |   |                                       |
| for         |   |            |   |                                       |
| unexpected  |   |            |   |                                       |
| and         |   |            |   |                                       |
| u           |   |            |   |                                       |
| nauthorized |   |            |   |                                       |
| changes to  |   |            |   |                                       |
| check for   |   |            |   |                                       |
| data        |   |            |   |                                       |
| integrity?  |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| Is there a  |   |            |   | \[Click here and Type Response\]      |
| process in  |   |            |   |                                       |
| place for   |   |            |   |                                       |
| handling a  |   |            |   |                                       |
| computer    |   |            |   |                                       |
| security    |   |            |   |                                       |
| incident?   |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| What are    |   |            |   | \[Click here and Type Response\]      |
| the         |   |            |   |                                       |
| measures in |   |            |   |                                       |
| place to    |   |            |   |                                       |
| perform a   |   |            |   |                                       |
| Security    |   |            |   |                                       |
| Vu          |   |            |   |                                       |
| lnerability |   |            |   |                                       |
| Assessment  |   |            |   |                                       |
| and         |   |            |   |                                       |
| Analysis?   |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+
| \[Click     |   |            |   | \[Click here and Type Response\]      |
| here and    |   |            |   |                                       |
| Type        |   |            |   |                                       |
| Additional  |   |            |   |                                       |
| Questions\] |   |            |   |                                       |
+-------------+---+------------+---+---------------------------------------+

+-----------+-------------+--------------------------------------------+
| ####      |             |                                            |
| # TECHNIC |             |                                            |
| AL THREAT |             |                                            |
| S {#techn |             |                                            |
| ical-thre |             |                                            |
| ats-3 .un |             |                                            |
| numbered} |             |                                            |
+-----------+-------------+--------------------------------------------+
| ###       | #####       | ##### EXAMPLES {#examples-10 .unnumbered}  |
| ## THREAT |  DESCRIPTIO |                                            |
| S {#threa | NS {#descri |                                            |
| ts-10 .un | ptions-10 . |                                            |
| numbered} | unnumbered} |                                            |
+-----------+-------------+--------------------------------------------+
| #         | The         | Data values that stray from their field    |
| # Data/Sy | intermixing | descriptions and business rules could be   |
| stem Cont | of data of  | revealed to unauthorized persons.          |
| amination | different   |                                            |
|           | sensitivity | Anomalies and multiple account numbers for |
| *[System  | levels      | the same entity could allow unauthorized   |
| Im        | could lead  | access to data.                            |
| pact]{.un | to an       |                                            |
| derline}* | accidental  | Corrupted system files could contain       |
|           | or          | strings of sensitive information.          |
| Could     | intentional |                                            |
| sign      | violation   | File fragments containing sensitive        |
| ificantly | of data     | information could be scattered throughout  |
| impact    | integrity.  | a drive instead of in an encrypted sector  |
| data      |             | to protect them from compromise.           |
| confide   |             |                                            |
| ntiality, |             | Cross-site scripting attacks (CSS) could   |
| and to a  |             | be launched by inserting malicious tagging |
| lesser    |             | as an input into dynamically generated web |
| extent    |             | pages. Malicious tagging could enable an   |
| data      |             | attacker to accomplish compromise of data  |
| integrity |             | integrity, set and read cookies, intercept |
| and       |             | user input and execute malicious scripts   |
| availa    |             | by the client in the context of the        |
| bility*.* |             | trusted source. For example, Citibank      |
|           |             | closed a CSS vulnerability identified by   |
|           |             | De Vitry at the bank\'s C2IT.com Internet  |
|           |             | payment site that enabled attackers to     |
|           |             | grab users\' credit card and bank account  |
|           |             | information.                               |
+-----------+-------------+--------------------------------------------+
| **[QUESTI |             | **[RESPONSES]{.underline}**                |
| ONS]{.und |             |                                            |
| erline}** |             | **[(Each response should be entered in a   |
|           |             | Detailed Risk Description                  |
| **[A      |             | Chart)]{.underline}**                      |
| dditional |             |                                            |
| questions |             |                                            |
| specific  |             |                                            |
| to the    |             |                                            |
| system    |             |                                            |
| under     |             |                                            |
| review    |             |                                            |
| may be    |             |                                            |
| added in  |             |                                            |
| this      |             |                                            |
| secti     |             |                                            |
| on.]{.und |             |                                            |
| erline}** |             |                                            |
+-----------+-------------+--------------------------------------------+
| Is an     |             | \[Click here and Type Response\]           |
| In        |             |                                            |
| formation |             |                                            |
| Se        |             |                                            |
| nsitivity |             |                                            |
| A         |             |                                            |
| ssessment |             |                                            |
| performed |             |                                            |
| for       |             |                                            |
| different |             |                                            |
| data in   |             |                                            |
| the       |             |                                            |
| system?   |             |                                            |
+-----------+-------------+--------------------------------------------+
| What are  |             | \[Click here and Type Response\]           |
| the       |             |                                            |
| controls  |             |                                            |
| in place  |             |                                            |
| to check  |             |                                            |
| on the    |             |                                            |
| in        |             |                                            |
| termixing |             |                                            |
| of data   |             |                                            |
| of        |             |                                            |
| different |             |                                            |
| se        |             |                                            |
| nsitivity |             |                                            |
| levels?   |             |                                            |
+-----------+-------------+--------------------------------------------+
| What are  |             | \[Click here and Type Response\]           |
| the       |             |                                            |
| controls  |             |                                            |
| in place  |             |                                            |
| to        |             |                                            |
| prevent   |             |                                            |
| multiple  |             |                                            |
| accounts  |             |                                            |
| for the   |             |                                            |
| same      |             |                                            |
| entity?   |             |                                            |
+-----------+-------------+--------------------------------------------+
| What are  |             | \[Click here and Type Response\]           |
| the       |             |                                            |
| controls  |             |                                            |
| in place  |             |                                            |
| to check  |             |                                            |
| against   |             |                                            |
| file      |             |                                            |
| frag      |             |                                            |
| mentation |             |                                            |
| on the    |             |                                            |
| system?   |             |                                            |
+-----------+-------------+--------------------------------------------+
| What are  |             | \[Click here and Type Response\]           |
| the       |             |                                            |
| controls  |             |                                            |
| in place  |             |                                            |
| to        |             |                                            |
| protect   |             |                                            |
| the       |             |                                            |
| system    |             |                                            |
| from      |             |                                            |
| cross-    |             |                                            |
| site      |             |                                            |
| scripting |             |                                            |
| attacks?  |             |                                            |
+-----------+-------------+--------------------------------------------+
| \[Click   |             | \[Click here and Type Response\]           |
| here and  |             |                                            |
| Type      |             |                                            |
| A         |             |                                            |
| dditional |             |                                            |
| Qu        |             |                                            |
| estions\] |             |                                            |
+-----------+-------------+--------------------------------------------+

+----------------+------------------+----------------------------------+
| ##             |                  |                                  |
| ### TECHNICAL  |                  |                                  |
| THREATS {#tech |                  |                                  |
| nical-threats- |                  |                                  |
| 4 .unnumbered} |                  |                                  |
+----------------+------------------+----------------------------------+
| ##### THREA    | #                | ##### EXA                        |
| TS {#threats-1 | #### DESCRIPTION | MPLES {#examples-11 .unnumbered} |
| 1 .unnumbered} | S {#descriptions |                                  |
|                | -11 .unnumbered} |                                  |
+----------------+------------------+----------------------------------+
| ##             | The deliberate   | Eavesdropping devices, such as   |
|  Eavesdropping | attempt to gain  | Electronic Bugs, could be used   |
|                | knowledge of     | to intercept sensitive,          |
| *[System       | protected        | unencrypted data. For example,   |
| Impact         | information. The | Keystroke monitoring could       |
| ]{.underline}* | unauthorized     | transmit every keystroke so that |
|                | disclosure of    | all user input could be          |
| Could          | protected        | reproduced.                      |
| significantly  | information      |                                  |
| impact data    | leads to         | Trojan Horse applications could  |
| co             | information      | surreptitiously capture user or  |
| nfidentiality, | misuse (identity | system activities.               |
| but combined   | theft), or such  |                                  |
| with other     | information      |                                  |
| threats could  | could be used to |                                  |
| impact data    | gain additional  |                                  |
| integrity and  | access or        |                                  |
| availability   | information.     |                                  |
| as well.       |                  |                                  |
+----------------+------------------+----------------------------------+
| **[QUESTIONS]  |                  | **[RESPONSES]{.underline}**      |
| {.underline}** |                  |                                  |
|                |                  | **[(Each response should be      |
| **[Additional  |                  | entered in a Detailed Risk       |
| questions      |                  | Description                      |
| specific to    |                  | Chart)]{.underline}**            |
| the system     |                  |                                  |
| under review   |                  |                                  |
| may be added   |                  |                                  |
| in this        |                  |                                  |
| section.]      |                  |                                  |
| {.underline}** |                  |                                  |
+----------------+------------------+----------------------------------+
| What are the   |                  | \[Click here and Type Response\] |
| security       |                  |                                  |
| controls in    |                  |                                  |
| place to       |                  |                                  |
| protect the    |                  |                                  |
| system from    |                  |                                  |
| brute password |                  |                                  |
| cracking and   |                  |                                  |
| password       |                  |                                  |
| guessing?      |                  |                                  |
+----------------+------------------+----------------------------------+
| How is the     |                  | \[Click here and Type Response\] |
| system         |                  |                                  |
| protected from |                  |                                  |
| the            |                  |                                  |
| installation   |                  |                                  |
| of software    |                  |                                  |
| and devices    |                  |                                  |
| such as        |                  |                                  |
| electronic     |                  |                                  |
| bugs and       |                  |                                  |
| keystroke      |                  |                                  |
| listeners?     |                  |                                  |
+----------------+------------------+----------------------------------+
| What controls  |                  | \[Click here and Type Response\] |
| are in place   |                  |                                  |
| to check for   |                  |                                  |
| the            |                  |                                  |
| installation   |                  |                                  |
| of Trojan      |                  |                                  |
| Horses on the  |                  |                                  |
| system?        |                  |                                  |
+----------------+------------------+----------------------------------+
| \[Click here   |                  | \[Click here and Type Response\] |
| and Type       |                  |                                  |
| Additional     |                  |                                  |
| Questions\]    |                  |                                  |
+----------------+------------------+----------------------------------+

+-----------+--------------+-------------------------------------------+
| #####     |              |                                           |
|   TECHNIC |              |                                           |
| AL THREAT |              |                                           |
| S {#techn |              |                                           |
| ical-thre |              |                                           |
| ats-5 .un |              |                                           |
| numbered} |              |                                           |
+-----------+--------------+-------------------------------------------+
| ###       | #            | ##### EXAMPLES {#examples-12 .unnumbered} |
| ## THREAT | #### DESCRIP |                                           |
| S {#threa | TIONS {#desc |                                           |
| ts-12 .un | riptions-12  |                                           |
| numbered} | .unnumbered} |                                           |
+-----------+--------------+-------------------------------------------+
| ##        | The          | Modification, insertion, or deletion of   |
|  Insertio | malicious    | data or lines of code could compromise    |
| n of Mali | intent to    | data and/or systems.                      |
| cious Cod | change a     |                                           |
| e/Softwar | system's     | Unauthorized modification of database     |
| e; or Una | c            | records could compromise data integrity   |
| uthorized | onfiguration | and availability.                         |
|  Modifica | without      |                                           |
| tion of a | a            | Trojan Horse applications could be        |
|  Database | uthorization | installed through code and software       |
|           | by the       | modifications. Some examples are SubSeven |
| *[System  | addition or  | Trojan, NetBus, BackOrifice, NetCat and   |
| Im        | modification | Deep Throat                               |
| pact]{.un | of code,     |                                           |
| derline}* | software,    | Logic bombs could be placed within        |
|           | database     | authorized software and perform malicious |
| Could     | records, or  | system actions on a given trigger event.  |
| sign      | information. |                                           |
| ificantly | The intent   | Trap door functions could be inserted     |
| impact    | and impact   | into authorized code and software.        |
| data      | could range  |                                           |
| confide   | from subtle  | Improper database entries and updates     |
| ntiality, | annoyances   | could be executed.                        |
| i         | and          |                                           |
| ntegrity, | in           |                                           |
| and       | conveniences |                                           |
| avai      | to           |                                           |
| lability. | catastrophic |                                           |
|           | failures and |                                           |
|           | outages.     |                                           |
+-----------+--------------+-------------------------------------------+
| **[QUESTI |              | **[RESPONSES]{.underline}**               |
| ONS]{.und |              |                                           |
| erline}** |              | **[(Each response should be entered in a  |
|           |              | Detailed Risk Description                 |
| **[A      |              | Chart)]{.underline}**                     |
| dditional |              |                                           |
| questions |              |                                           |
| specific  |              |                                           |
| to the    |              |                                           |
| system    |              |                                           |
| under     |              |                                           |
| review    |              |                                           |
| may be    |              |                                           |
| added in  |              |                                           |
| this      |              |                                           |
| secti     |              |                                           |
| on.]{.und |              |                                           |
| erline}** |              |                                           |
+-----------+--------------+-------------------------------------------+
| What      |              | \[Click here and Type Response\]          |
| controls  |              |                                           |
| are in    |              |                                           |
| place to  |              |                                           |
| protect   |              |                                           |
| the       |              |                                           |
| system    |              |                                           |
| from the  |              |                                           |
| ins       |              |                                           |
| tallation |              |                                           |
| of        |              |                                           |
| software  |              |                                           |
| programs  |              |                                           |
| and       |              |                                           |
| co        |              |                                           |
| mpilation |              |                                           |
| of code?  |              |                                           |
+-----------+--------------+-------------------------------------------+
| What      |              | \[Click here and Type Response\]          |
| controls  |              |                                           |
| are in    |              |                                           |
| place to  |              |                                           |
| protect   |              |                                           |
| the       |              |                                           |
| mod       |              |                                           |
| ification |              |                                           |
| of        |              |                                           |
| database  |              |                                           |
| records?  |              |                                           |
+-----------+--------------+-------------------------------------------+
| What      |              | \[Click here and Type Response\]          |
| controls  |              |                                           |
| are in    |              |                                           |
| place to  |              |                                           |
| check     |              |                                           |
| against   |              |                                           |
| the       |              |                                           |
| ins       |              |                                           |
| tallation |              |                                           |
| of Trojan |              |                                           |
| Horses on |              |                                           |
| the       |              |                                           |
| system?   |              |                                           |
+-----------+--------------+-------------------------------------------+
| Are there |              | \[Click here and Type Response\]          |
| specific  |              |                                           |
| ap        |              |                                           |
| plication |              |                                           |
| software  |              |                                           |
| m         |              |                                           |
| anagement |              |                                           |
| p         |              |                                           |
| rocedures |              |                                           |
| in place? |              |                                           |
+-----------+--------------+-------------------------------------------+
| \[Click   |              | \[Click here and Type Response\]          |
| here and  |              |                                           |
| Type      |              |                                           |
| A         |              |                                           |
| dditional |              |                                           |
| Qu        |              |                                           |
| estions\] |              |                                           |
+-----------+--------------+-------------------------------------------+

+-----------------+----------------+------------------------------------+
| ##### TECHNIC   |                |                                    |
| AL THREATS {#te |                |                                    |
| chnical-threats |                |                                    |
| -6 .unnumbered} |                |                                    |
+-----------------+----------------+------------------------------------+
| ##### THR       | ##### D        | ##### E                            |
| EATS {#threats- | ESCRIPTIONS {# | XAMPLES {#examples-13 .unnumbered} |
| 13 .unnumbered} | descriptions-1 |                                    |
|                 | 3 .unnumbered} |                                    |
+-----------------+----------------+------------------------------------+
| ##              | Gaining        | Network sessions could be          |
| Takeover of Aut | control of an  | compromised through session        |
| horized Session | authorized     | hijacking techniques.              |
|                 | session, and   |                                    |
| *[System        | assuming the   | When a user leaves the immediate   |
| Impac           | access rights  | work area and a session remains    |
| t]{.underline}* | of the         | open, unauthorized use could       |
|                 | authorized     | occur.                             |
| Could           | party. This    |                                    |
| significantly   | session could  | Database communications could be   |
| impact data     | be used for    | captured, modified, and sent back  |
| c               | further        | to the hackers originating         |
| onfidentiality, | unauthorized   | destination.                       |
| and to a lesser | access.        |                                    |
| extent data     |                |                                    |
| integrity and   |                |                                    |
| availability.   |                |                                    |
+-----------------+----------------+------------------------------------+
| **[QUESTIONS    |                | **[RESPONSES]{.underline}**        |
| ]{.underline}** |                |                                    |
|                 |                | **[(Each response should be        |
| **[Additional   |                | entered in a Detailed Risk         |
| questions       |                | Description Chart)]{.underline}**  |
| specific to the |                |                                    |
| system under    |                |                                    |
| review may be   |                |                                    |
| added in this   |                |                                    |
| section.        |                |                                    |
| ]{.underline}** |                |                                    |
+-----------------+----------------+------------------------------------+
| How are the     |                | \[Click here and Type Response\]   |
| network         |                |                                    |
| sessions        |                |                                    |
| protected from  |                |                                    |
| session         |                |                                    |
| hijacking/IP    |                |                                    |
| spoofing? E.g., |                |                                    |
| use of random   |                |                                    |
| TCP sequence    |                |                                    |
| numbers.        |                |                                    |
+-----------------+----------------+------------------------------------+
| Are there       |                | \[Click here and Type Response\]   |
| controls in     |                |                                    |
| place to        |                |                                    |
| protect the     |                |                                    |
| system from     |                |                                    |
| takeover by an  |                |                                    |
| unauthorized    |                |                                    |
| person? e.g.,   |                |                                    |
| is session      |                |                                    |
| timeout         |                |                                    |
| implemented?    |                |                                    |
+-----------------+----------------+------------------------------------+
| Are there logon |                | \[Click here and Type Response\]   |
| time            |                |                                    |
| restrictions in |                |                                    |
| place?          |                |                                    |
+-----------------+----------------+------------------------------------+
| How are         |                | \[Click here and Type Response\]   |
| database        |                |                                    |
| communications  |                |                                    |
| protected from  |                |                                    |
| modification?   |                |                                    |
| e.g.,           |                |                                    |
| encryption      |                |                                    |
+-----------------+----------------+------------------------------------+
| How are users   |                | \[Click here and Type Response\]   |
| informed of the |                |                                    |
| importance of   |                |                                    |
| locking         |                |                                    |
| desktops?       |                |                                    |
+-----------------+----------------+------------------------------------+
| Are there       |                | \[Click here and Type Response\]   |
| controls in     |                |                                    |
| place to lock   |                |                                    |
| desktops after  |                |                                    |
| a period of     |                |                                    |
| inactivity?     |                |                                    |
+-----------------+----------------+------------------------------------+
| \[Click here    |                | \[Click here and Type Response\]   |
| and Type        |                |                                    |
| Additional      |                |                                    |
| Questions\]     |                |                                    |
+-----------------+----------------+------------------------------------+

+----------------+------------------+----------------------------------+
| ##             |                  |                                  |
| ### TECHNICAL  |                  |                                  |
| THREATS {#tech |                  |                                  |
| nical-threats- |                  |                                  |
| 7 .unnumbered} |                  |                                  |
+----------------+------------------+----------------------------------+
| ##### THREA    | #                | ##### EXA                        |
| TS {#threats-1 | #### DESCRIPTION | MPLES {#examples-14 .unnumbered} |
| 4 .unnumbered} | S {#descriptions |                                  |
|                | -14 .unnumbered} |                                  |
+----------------+------------------+----------------------------------+
| ##  Sys        | Auditing and     | Auditing and logging settings    |
| tem and Applic | logging of       | not properly configured at the   |
| ation Errors,  | system and       | system and application level     |
| Failures, and  | application      | could prevent tracking of        |
| Intrusions not | errors enable    | malicious acts.                  |
|  Properly Audi | administrators   |                                  |
| ted and Logged | to troubleshoot  | Intruders could gain             |
|                | and safeguard    | unauthorized system access and   |
| *[System       | performance      | abort auditing processes.        |
| Impact         | issues, and      |                                  |
| ]{.underline}* | reconstruct      | If Audit logs reach their        |
|                | events of        | maximum threshold they could     |
| Could          | unauthorized     | remove logged data, or stop      |
| significantly  | access. The lack | logging new data.                |
| impact data    | of sufficient    |                                  |
| integrity and  | auditing and     |                                  |
| availability.  | logging inhibits |                                  |
|                | these            |                                  |
|                | capabilities.    |                                  |
+----------------+------------------+----------------------------------+
| **[QUESTIONS]  |                  | **[RESPONSES]{.underline}**      |
| {.underline}** |                  |                                  |
|                |                  | **[(Each response should be      |
| **[Additional  |                  | entered in a Detailed Risk       |
| questions      |                  | Description                      |
| specific to    |                  | Chart)]{.underline}**            |
| the system     |                  |                                  |
| under review   |                  |                                  |
| may be added   |                  |                                  |
| in this        |                  |                                  |
| section.]      |                  |                                  |
| {.underline}** |                  |                                  |
+----------------+------------------+----------------------------------+
| What are the   |                  | \[Click here and Type Response\] |
| auditing and   |                  |                                  |
| logging        |                  |                                  |
| procedures in  |                  |                                  |
| place to check |                  |                                  |
| for system     |                  |                                  |
| application    |                  |                                  |
| errors and     |                  |                                  |
| events?        |                  |                                  |
+----------------+------------------+----------------------------------+
| How are        |                  | \[Click here and Type Response\] |
| critical files |                  |                                  |
| audited and    |                  |                                  |
| logged?        |                  |                                  |
+----------------+------------------+----------------------------------+
| What are the   |                  | \[Click here and Type Response\] |
| controls in    |                  |                                  |
| place to       |                  |                                  |
| ensure that    |                  |                                  |
| system audit   |                  |                                  |
| logs are       |                  |                                  |
| protected from |                  |                                  |
| compromise?    |                  |                                  |
+----------------+------------------+----------------------------------+
| What are the   |                  | \[Click here and Type Response\] |
| controls in    |                  |                                  |
| place to       |                  |                                  |
| protect audit  |                  |                                  |
| logs from      |                  |                                  |
| compromise?    |                  |                                  |
+----------------+------------------+----------------------------------+
| \[Click here   |                  | \[Click here and Type Response\] |
| and Type       |                  |                                  |
| Additional     |                  |                                  |
| Questions\]    |                  |                                  |
+----------------+------------------+----------------------------------+

+-----------+-----------------------+----------------------------------+
| ####      |                       |                                  |
| # TECHNIC |                       |                                  |
| AL THREAT |                       |                                  |
| S {#techn |                       |                                  |
| ical-thre |                       |                                  |
| ats-8 .un |                       |                                  |
| numbered} |                       |                                  |
+===========+=======================+==================================+
| ###       | ##### D               | ##### EXA                        |
| ## THREAT | ESCRIPTIONS {#descrip | MPLES {#examples-15 .unnumbered} |
| S {#threa | tions-15 .unnumbered} |                                  |
| ts-15 .un |                       |                                  |
| numbered} |                       |                                  |
+-----------+-----------------------+----------------------------------+
| ## Othe   | (To be specified by   |                                  |
| r Threats | system owner or       |                                  |
|           | developer.)           |                                  |
+-----------+-----------------------+----------------------------------+
| **[QUESTI |                       | **[RESPONSES]{.underline}**      |
| ONS]{.und |                       |                                  |
| erline}** |                       | **[(Each response should be      |
|           |                       | entered in a Detailed Risk       |
| **[A      |                       | Description                      |
| dditional |                       | Chart)]{.underline}**            |
| questions |                       |                                  |
| specific  |                       |                                  |
| to the    |                       |                                  |
| system    |                       |                                  |
| under     |                       |                                  |
| review    |                       |                                  |
| may be    |                       |                                  |
| added in  |                       |                                  |
| this      |                       |                                  |
| secti     |                       |                                  |
| on.]{.und |                       |                                  |
| erline}** |                       |                                  |
+-----------+-----------------------+----------------------------------+
| \[Click   |                       | \[Click here and Type Response\] |
| here and  |                       |                                  |
| Type      |                       |                                  |
| A         |                       |                                  |
| dditional |                       |                                  |
| Qu        |                       |                                  |
| estions\] |                       |                                  |
+-----------+-----------------------+----------------------------------+
| \[Click   |                       | \[Click here and Type Response\] |
| here and  |                       |                                  |
| Type      |                       |                                  |
| A         |                       |                                  |
| dditional |                       |                                  |
| Qu        |                       |                                  |
| estions\] |                       |                                  |
+-----------+-----------------------+----------------------------------+
| \[Click   |                       | \[Click here and Type Response\] |
| here and  |                       |                                  |
| Type      |                       |                                  |
| A         |                       |                                  |
| dditional |                       |                                  |
| Qu        |                       |                                  |
| estions\] |                       |                                  |
+-----------+-----------------------+----------------------------------+