This Risk Assessment must be completed in addition to the Part 2 for the particular computer operating system in use for this FTP server. Vulnerability and Countermeasure Check List. Mark each as T rue, F alse, or NA - not applicable. In the absence of indications to the contrary, the Information System is operating at an acceptable risk when all of the leftmost countermeasures are marked 'True'.
All administrators have access to the space in which the server is located.
Automated audit logs are maintained for at least 1 year. FTP connection activity is logged in syslog or similar. Auditing is configured to record complete ftp transactions. The following is auditable information for each event. Date and time.