3.0 Conclusion Table 3-1: Risks that must be Remediated within 30 days of ATO or Receive an Exception/Waiver Prior to ATO Exception / Waiver Traceability Risks Affected Elements Risk Level Recommended Remediation Compensating Measure [E-# OR W-#] Damage Protection [NIST 800-53 w/ DHS 4300A PE-15] [Test: PE-15.1 - Water Damage Protection] Not Entered Failure to ensure that the organization protects the information system from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly, and known to key personnel could lead to the compromise of the system or of the data in the system. High [Test: PE-15.1 - Water Damage Protection] Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS 4300A CA-1] [Test: CA-1.1 - Security Assessment and Authorization Policies and Procedures] Not Entered [Test: CA-1.2 - Security Assessment and Authorization Policies and Procedures] Failure to meet the certification, accreditation, and security assessment policies and procedures requirements listed below could result in a weak security stance of the organization due to security threats that may not have been addressed accordingly or completely by organizational personnel with certification, accreditation and assessment roles and responsibilities: (i) the organization defines the High [Test: CA-1.1 - Security Assessment and Authorization Policies and Procedures] Not Entered [Test: CA-1.2 - Security Assessment and Authorization Policies and Procedures] Not Entered
organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; (ii) the organization defines the frequency of the information security program plan reviews; (iii) the organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments; and (iv) the organization protects the information security program plan from unauthorized disclosure and modification. [E-# OR W-#] Identifier Management [NIST 800-53 w/ DHS 4300A IA-4] [Test: IA-4.1 - Identifier Management] Not Entered Failure to meet the identifier management requirements listed could expose information system to unauthorized access and lead to compromise of information system integrity and High [Test: IA-4.1 - Identifier Management] Not Entered organization- wide
time period; and disabling the user identifier after the organization-defined time period of inactivity. [E-# OR W-#] Personnel Security Policy and Procedures [NIST 800-53 w/ DHS 4300A PS-1] [Test: PS-1.1 - Personnel Security Policy and Procedures] Not Entered [Test: PS-1.2 - Personnel Security Policy and Procedures] Not Entered Failure to meet the personnel security policy and procedures requirements listed below could result in the incomplete and ineffective personnel security policy and procedures leaving the personnel/employee with a different interpretation of the policy, which could lead to the abuse of information system resources and possibly to the compromise of the system or data: (i) the organization defines the frequency of personnel security policy reviews/updates; (ii) the organization reviews/updates personnel security policy in accordance with organization-defined frequency; and (iii) the organization defines the frequency of personnel security procedure reviews/updates; High [Test: PS-1.1 - Personnel Security Policy and Procedures] Not Entered [Test: PS-1.2 - Personnel Security Policy and Procedures] Not Entered defined
Retention] Not Entered which could render an audit or forensic investigation efforts useless: (i) the organization defines the retention period for audit records; (ii) the retention period for audit records is consistent with the records retention policy; and, (iii) the organization retains audit records for the organization-defined time period consistent with the records retention policy to provide support for investigations of security incidents and to meet regulatory and organizational information retention requirements. Not Entered [E-# OR W-#] Publicly Accessible Content [NIST w/ DHS 4300A AC-22] [Test: AC-22.1 - Publicly Accessible Content] Not Entered Failure to meet the publicly accessible content requirements listed could leave essential data exposed to unauthorized access and viewing by individuals not connected to the organization: (i) the organization designates individuals authorized to post information onto an High [Test: AC-22.1 - Publicly Accessible Content] Not Entered
incidents to the organizational incident response capability; (ii) the organization requires personnel to report suspected security incidents to the organizational incident response capability within the organization-defined time period; and (iii) the organization reports security incident information to designated authorities. [E-# OR W-#] Minimization of Personally Identifiable Information [NIST 800-53 w/ DHS 4300A [Test: DM-1.1 - Minimization of Personally Identifiable Information] Not Entered Failure to meet the data minimization and retention requirements listed could lead to the compromise or unauthorized disclosure of personally identifiable information: (i) the organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection; (ii) the organization limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has High [Test: DM-1.1 - Minimization of Personally Identifiable Information] Not Entered
[E-# OR W-#] Contacts with Security Groups and Associations [NIST 800-53 w/ DHS 4300A PM-15] [Test: PM-15.1 - Contacts with Security Groups and Associations] Not Entered Failure to ensure that the organization establishes and institutionalizes contact with selected groups and associations within the security community that are indicated below could result in the ignorance of basic security practices, which could be taken advantage of by would-be attackers seeking to break into the information system of the organization through several foot-printing methods including, but not limited to, phishing and social engineering: (i) To facilitate ongoing security education and training for organizational personnel; (ii) To maintain currency with recommended security practices, techniques, and technologies; and (iii) To share current information including threats, vulnerabilities, and incidents. High [Test: PM-15.1 - Contacts with Security Groups and Associations] Not Entered [E-# OR W-#] Unsuccessful Logon Attempts [NIST Failure to meet the unsuccessful attempts High [Test: AC-7.1 - Unsuccessful related
(iii) the organization includes Privacy Act Statements on its forms that collect PII, or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected. [E-# OR W-#] Fire Protection [NIST 800-53 w/ DHS 4300A PE-13] [Test: PE-13.1 - Fire Protection] Not Entered Failure to ensure that the organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source lead to the disruption of critical mission/business operations. High [Test: PE-13.1 - Fire Protection] Not Entered [E-# OR W-#] Contingency Plan [NIST 800-53 w/ DHS 4300A CP-2] [Test: CP-2.1 - Contingency Plan] Not Entered [Test: CP-2.2 - Contingency Plan] Not Entered Failure to meet the contingency plan requirements listed below could leave the organization unprepared for any incident when it occurs due to incomplete or inaccurate plan and procedures, which could lead to the compromise of the system or of the data in the system: (i) the organization coordinates contingency planning activities with incident handling activities: High [Test: CP-2.1 - Contingency Plan] Not Entered [Test: CP-2.2 - Contingency Plan] Not Entered
use or sharing of PII; and (iv) the organization evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. [E-# OR W-#] Internal System Connections [NIST 800-53 w/ DHS 4300A CA-9] [Test: CA-9.1 - Internal System Connections] Not Entered Failure to meet the internal system connection requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization authorizes internal connections of system components or classes of components to the information system; and, (ii) the organization documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated. High [Test: CA-9.1 - Internal System Connections] Not Entered [E-# OR W-#] Security Awareness and Training Policy and Procedures [NIST 800-53 w/ DHS 4300A AT-1] [Test: AT-1.1 - Security Awareness and Training Policy and Procedures] Failure to meet the requirements for security awareness and training policy and procedures indicated below could result in the ignorance of basic security practices, which could be taken advantage of by High [Test: AT-1.1 - Security Awareness and Training Policy and Procedures] Not Entered
[Test: SA-1.2 - System and Services Acquisition Policy and Procedures] Not Entered mission/business assets or the disruption of organization operations, functions and services: (i) the organization develops and formally documents system services and acquisition policy; (ii) the organization system services and acquisition policy addresses: purpose; scope; roles and responsibilities; management commitment; coordination among organizational entities; and compliance; (iii) the organization disseminates formal documented system services and acquisition policy to elements within the organization having associated system services and acquisition roles and responsibilities; Acquisition Policy and Procedures] Not Entered
[E-# OR W-#] Privacy Awareness and Training [NIST 800-53 w/ DHS 4300A PRIV-AR-5] [Test: AR-5.1 - Privacy Awareness and Training] Not Entered Failure to meet the privacy awareness training requirements listed below could affect the readiness of personnel to respond to unexpected attacks and intrusion: (i) the organization develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures; (ii) the organization administers the following privacy privacy training at least annually: basic privacy training targeted, role-based privacy training for personnel having responsibility for PII or for activities that involve PII (iii) the organization ensures that personnel certify (manually or electronically) acceptance of responsibilities High [Test: AR-5.1 - Privacy Awareness and Training] Not Entered
for privacy requirements at annually. [E-# OR W-#] Dissemination of Privacy Program Information [NIST 800-53 w/ DHS 4300A PRIV-TR-3] [Test: TR-3.1 - Dissemination of Privacy Program Information] Not Entered Failure to meet the privacy program information dissemination requirements listed increases the risk to unauthorized disclosure of personally identifiable information: (i) the organization ensures that the public has access to information about its privacy activities and is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO); and (ii) the organization ensures that its privacy practices are publicly available through organizational Web sites or otherwise. High [Test: TR-3.1 - Dissemination of Privacy Program Information] Not Entered [E-# OR W-#] Redress [NIST w/ DHS 4300A PRIV-IP-3] [Test: IP-3.1 - Redress] Not Entered Failure to meet the redress requirements listed below increases could allow unauthorized individuals to view privacy information and disclose them without consent to other individuals: (i) the organization provides a process for individuals to have High [Test: IP-3.1 - Redress] Not Entered
[E-# OR W-#] Security Assessments [NIST 800-53 w/ DHS 4300A CA-2] [Test: CA-2.1 - Security Assessments] Not Entered Failure to meet the security assessments requirements listed could lead to compromise of the system or of the data in the system: (i) the organization develops a security assessment plan for the information system; and, (ii) the security assessment plan describes the scope of the assessment including: security controls and control enhancements under assessment; assessment procedures to be used to determine security control effectiveness; and, assessment environment, assessment team, and assessment and responsibilities. High [Test: CA-2.1 - Security Assessments] Not Entered [E-# OR W-#] Privacy Monitoring and Auditing [NIST 800-53 w/ DHS PRIV-AR-4] [Test: AR-4.1 - Privacy Monitoring and Auditing] Not Entered Failure to ensure that the organization employs a schedule to monitor and privacy controls and internal privacy policy could result in the inability of the organization to track any security incident, High [Test: AR-4.1 - Privacy Monitoring and Auditing] Not Entered
determines, based on current threat information and ongoing assessment of risk, the subset of auditable events in (i) to be audited within the information system, and the frequency of (or situation requiring) auditing for each identified event. [E-# OR W-#] Information Security Measures of Performance [NIST 800-53 w/ DHS 4300A PM-6] [Test: PM-6.1 - Information Security Measures of Performance] Not Entered Failure to meet the information security measures of performance requirements listed below could risk the exposure of essential information compromising the confidentiality, integrity and availability of the system: (i) the organization develops an inventory of its information systems; and (ii) the organization maintains an inventory of its information systems. High [Test: PM-6.1 - Information Security Measures of Performance] Not Entered [E-# OR W-#] Access Agreements [NIST 800-53 w/ DHS PS-6] [Test: PS-6.1 - Access Agreements] Not Entered Failure to meet access agreements requirements indicated below could lead to disclosure of greater amount of information: (i) the organization develops and documents access agreements for organizational High [Test: PS-6.1 - Access Agreements] Not Entered
800-53 w/ DHS 4300A IR-7] [Test: IR-7.1 - Incident Response Assistance] Not Entered reporting listed below could lead to the compromise of the system or the misuse of data being processed, transported, or stored inside the system: (i) the organization provides an incident response support resource that offers advice and assistance to users of the information system for the handling and reporting of security incidents; and (ii) the incident response support resource is an integral part of the organization's incident response capability. Assistance] Not Entered [E-# OR W-#] Physical Access Authorizations [NIST 800-53 w/ DHS 4300A PE-2] [Test: PE-2.1 - Physical Access Authorizations] Not Entered [Test: PE-2.2 - Physical Access Authorizations] Not Entered Failure to meet the requirements for physical access authorizations listed below could lead to the compromise of the system or of the data in the system: (i) the organization identifies areas within the facility that are publicly accessible; (ii) the organization develops and keeps current lists of personnel with authorized access to the facility where the information system resides (except for those areas within High [Test: PE-2.1 - Physical Access Authorizations] Not Entered [Test: PE-2.2 - Physical Access Authorizations] Not Entered
Not Entered (i) the organization establishes usage restrictions and implementation guidance for organization-controlled portable and mobile devices; and, (ii) the organization authorizes connection of mobile devices meeting organizational usage restrictions and implementation guidance to organizational information systems; [E-# OR W-#] Contingency Planning Policy and Procedures [NIST 800-53 w/ DHS CP-1] [Test: CP-1.1 - Contingency Planning Policy and Procedures] Not Entered [Test: CP-1.2 - Contingency Planning Policy and Procedures] Not Entered Failure to meet the contingency planning policy and procedures requirements listed could leave the organization unprepared for any incident when it occurs due to incomplete or inaccurate plan and procedures, which could lead to the compromise of the system or of the data in the system: (i) the organization defines the frequency of contingency planning policy reviews/updates; (ii) the organization reviews/updates contingency planning policy in accordance with organization-defined frequency; High [Test: CP-1.1 - Contingency Planning Policy and Procedures] Not Entered [Test: CP-1.2 - Contingency Planning Policy and Procedures] Not Entered
Remote Access] Not Entered information system for all allowed methods of remote access to include both establishment of the remote connection and subsequent user actions across that connection could enable attackers to effect a system breach and cause damage to resources therein: (i) establishes usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and, (ii) authorizes remote access to the information system prior to allowing such connections. Not Entered [E-# OR W-#] System Maintenance Policy and Procedures [NIST 800-53 w/ DHS MA-1] [Test: MA-1.1 - System Maintenance Policy and Procedures] Not Entered [Test: MA-1.2 - System Maintenance Policy and Procedures] Failure to meet the system maintenance policy and procedures requirements indicated below could result in malfunctioning systems due to incomplete and ineffective maintenance procedures, which could lead eventually to the system losing its stability or its integrity: (i) the organization defines the frequency of system High [Test: MA-1.1 - System Maintenance Policy and Procedures] Not Entered [Test: MA-1.2 - System Maintenance Policy and Procedures] Not Entered
800-53 w/ DHS 4300A CM-10] Software Usage Restrictions] Not Entered overall security posture of the system: (i) the organization uses software and associated documentation in accordance with contract agreements and copyright laws; (ii) the organization tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and, (iii) the organization controls and documents the use of file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. Not Entered [E-# OR W-#] Purpose Specification [NIST 800-53 w/ DHS PRIV-AP-2] [Test: AP-2.1 - Purpose Specification] Not Entered Failure to meet the privacy control requirements for collecting PIIs listed below could lead to unauthorized disclosure of personal identifiable information: (i) the organization identifies the legal bases that authorize a particular personally identifiable information (PII) collection or activity that High [Test: AP-2.1 - Purpose Specification] Not Entered
in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance. [E-# OR W-#] Privacy Reporting [NIST 800-53 w/ DHS 4300A [Test: AR-6.1 - Privacy Reporting] Not Entered Failure to meet the privacy reporting requirements listed could lead to the compromise of the system or the misuse of PII or other classified information stored inside the system: (i) the organization conducts internal and external privacy reporting. (ii) the organization submits privacy reports such as the following: annual Senior Agency Official for Privacy (SAOP) reports to OMB; reports to Congress required by the Implementing Regulations of the 9/11 Commission Act; and, other public reports required by specific statutory mandates or High [Test: AR-6.1 - Privacy Reporting] Not Entered
DHS 4300A Information Security Workforce] Not Entered development and improvement program result in the disclosure of critical/sensitive information or data, which could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes. Not Entered [E-# OR W-#] Access Control Policy and Procedures [NIST 800-53 w/ DHS 4300A AC-1] [Test: AC-1.1 - Access Control Policy and Procedures] Not Entered [Test: AC-1.2 - Access Control Policy and Procedures] Not Entered Failure to meet the access control policy and procedures requirements listed below could result in a weaker organizational structure where the policy conflicts with the trust, accountabilities, entities, interests, and requirements of the organization, which could lead to a weaker security posture enabling prospecting intruders to take advantage of the probable confusion and conflict brought about by an inadequate access control policy: (i) the organization defines the frequency of access control policy reviews/updates; (ii) the organization reviews/updates access control policy in accordance with High [Test: AC-1.1 - Access Control Policy and Procedures] Not Entered [Test: AC-1.2 - Access Control Policy and Procedures] Not Entered
associated security planning roles and responsibilities. [E-# OR W-#] Authenticator Feedback [NIST 800-53 w/ DHS IA-6] [Test: IA-6.1 - Authenticator Feedback] Not Entered Failure of the information system to obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals could lead to the compromise of the system or of the data in the system. High [Test: IA-6.1 - Authenticator Feedback] Not Entered [E-# OR W-#] Information System Inventory [NIST 800-53 w/ DHS 4300A PM-5] [Test: PM-5.1 - Information System Inventory] Not Entered Failure to ensure that the organization develops and maintains an inventory of its information systems could risk the exposure of essential information compromising the confidentiality, integrity and availability of the system. High [Test: PM-5.1 - Information System Inventory] Not Entered [E-# OR W-#] Media Access [NIST 800-53 w/ DHS 4300A MP-2] [Test: MP-2.1 - Media Access] Not Entered Failure to ensure that the organization defines digital and non-digital requiring restricted access to authorized individuals could lead to the compromise of the system or of the data in the system. High [Test: MP-2.1 - Media Access] Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2] [Test: AC-2.1 - Account Management] Failure to meet the account management requirements listed below could enable an intruder to gain access to a system account through social High [Test: AC-2.1 - Account Management] Not Entered
(iii) the organization retains individual training records in accordance with the organization-defined time period. [E-# OR W-#] Protection of Sensitive Paper and Electronic Outputs [NIST 800-53 w/ DHS 4300A MP-7 (DHS-4.3.1.f)] [Test: - Protection of Sensitive Paper and Electronic Outputs] Not Entered Failure of the components to follow established procedures to ensure that paper and electronic outputs from systems containing sensitive information are protected could result in the disclosure of critical and sensitive mission/business information that may have been contained in the media. High [Test: - Protection of Sensitive Paper and Electronic Outputs] Not Entered [E-# OR W-#] User-Installed Software [NIST 800-53 w/ DHS CM-11] [Test: CM-11.1 - User-Installed Software] Not Entered Failure to meet the software requirements listed below could weaken the overall security posture of the system: (i) the organization establishes organization-defined policies governing the installation of software by users; (ii) the organization enforces software installation policies through organization-defined methods; and, (iii) the organization monitors policy compliance at an High [Test: CM-11.1 - User-Installed Software] Not Entered
organization-defined frequency. [E-# OR W-#] Media Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A MP-1] [Test: MP-1.1 - Protection Policy and Procedures] Not Entered [Test: MP-1.2 - Media Protection Policy and Procedures] Not Entered Failure to meet the protection policy and procedures requirements indicated below could result in an ineffective media protection, which could eventually lead to the organization losing critical mission/business assets in the form of unauthorized or unintentional disclosure of information: (i) the organization defines the frequency of media protection policy reviews/updates; (ii) the organization reviews/updates media protection policy in accordance with organization-defined frequency; and (iii) the organization defines the frequency of media protection procedure reviews/updates; (iv) the organization reviews/updates media protection procedures in accordance with frequency. Failure to meet the media High [Test: MP-1.1 - Media Protection Policy and Procedures] Not Entered [Test: MP-1.2 - Media Protection Policy and Procedures] Not Entered
Not Entered to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data. Not Entered [E-# OR W-#] Time Stamps [NIST 800-53 w/ DHS 4300A AU-8] [Test: AU-8.1 - Time Stamps] Not Entered Failure to meet the time requirements listed below could lead to compromise of the system or of the data in the system: (i) the information system uses internal system clocks to generate time stamps for audit records; (ii) the information system generates time in the time stamps that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT); and, (iii) the organization defines different time granularities for different system components. High [Test: AU-8.1 - Time Stamps] Not Entered [E-# OR W-#] Cryptographic Module Authentication [NIST 800-53 w/ DHS 4300A IA-7] [Test: IA-7.1 - Cryptographic Module Authentication] Not Entered Failure of the information system to employ authentication methods that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module (for security systems, the High [Test: IA-7.1 - Cryptographic Module Authentication] Not Entered national
Not Entered information systems or system components using organization-defined security safeguards could result in the disclosure of critical and sensitive mission/business information that may have been contained in the media. [E-# OR W-#] Process Isolation [NIST 800-53 w/ DHS SC-39] [Test: SC-39.1 - Process Isolation] Not Entered Failure to ensure that the information system maintains a separate execution domain for each executing process could leave the system vulnerable to improper utilization of resources due to unmonitored activity of access. High [Test: SC-39.1 - Process Isolation] Not Entered [E-# OR W-#] Sharing of Personal Passwords [NIST 800-53 w/ DHS 4300A AC-1 [Test: - Sharing of Personal Passwords] Not Entered Failure to prevent DHS users to share personal passwords could leave the information system vulnerable to unauthorized access, impersonation, and brute force attacks. High [Test: - Sharing of Personal Passwords] Not Entered [E-# OR W-#] Authority to Collect [NIST 800-53 w/ DHS 4300A [Test: AP-1.1 - Authority to Collect] Not Entered Failure to meet the privacy control requirements for collecting PIIs listed below could lead to unauthorized disclosure of personal identifiable information: (i) the organization identifies the legal bases that authorize a particular personally High [Test: AP-1.1 - Authority to Collect] Not Entered
system-level information backups to support recovery time objectives and recovery point objectives; (iii) the organization defines the frequency of conducting information system documentation backups (including security-related information) to support recovery time objectives and recovery point objectives; (iv) the organization backs up user-level information in accordance with the organization-defined frequency; (v) the organization backs up system-level information in accordance with the organization-defined frequency; and (vi) the organization backs up information system documentation in accordance with the organization-defined frequency. [E-# OR W-#] Audit and Accountability Policy and Procedures [NIST 800-53 w/ DHS 4300A AU-1] [Test: AU-1.1 - Audit and Accountability Policy and Procedures] Failure to meet the requirements for audit and policy and procedures listed below could result in inaccurate audit and accountability reports: High [Test: AU-1.1 - and Accountability Policy and Procedures] Not Entered
reviews/updates; and (iv) the organization reviews/updates audit and accountability procedures in accordance with frequency. [E-# OR W-#] Identification and Authentication Users) [NIST w/ DHS 4300A IA-8] [Test: IA-8.1 - Identification and Not Entered Failure to ensure that the information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users) could leave the system vulnerable to unauthorized access and intrusion. High [Test: IA-8.1 - Identification and Users)] Not Entered [E-# OR W-#] Audit Storage Capacity [NIST 800-53 w/ DHS 4300A AU-4] [Test: AU-4.1 - Audit Storage Capacity] Not Entered Failure to meet the audit storage capacity requirements indicated below could result in lost data, which could prove detrimental to the success of a forensic or audit report: (i) the organization allocates audit record storage capacity; and, (ii) the organization configures auditing to reduce the likelihood of audit record storage capacity being exceeded. High [Test: AU-4.1 - Audit Storage Capacity] Not Entered [E-# OR W-#] Privacy Notice [NIST 800-53 w/ [Test: TR-1.1 - Failure to meet the privacy notice requirements listed below increases the risk to High [Test: TR-1.1 - Privacy Notice] Organizational Organizational
incident response procedures; training; and testing/exercises; and (iv) the organization implements the resulting changes to incident response procedures, training and testing/exercise accordingly. [E-# OR W-#] Allocation of Resources [NIST 800-53 w/ DHS 4300A SA-2] [Test: SA-2.1 - Allocation of Resources] Not Entered Failure to meet the resource allocation requirement listed below could result in the organization lacking the required security control being acquired and implemented, which could cause the loss of critical mission/business assets or the disruption of organization operations, functions and services: (i) the organization includes a determination of the information security requirements for the information system in mission/business process planning; (ii) the organization determines, documents, and allocates the resources required High [Test: SA-2.1 - Allocation of Resources] Not Entered
the event of an audit processing failure. [E-# OR W-#] Personnel Transfer [NIST 800-53 w/ DHS 4300A PS-5] [Test: PS-5.1 - Personnel Transfer] Not Entered Failure to meet the requirements for personnel transfer listed below could risk disclosure of organizational information: (i) the organization reviews logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization; (ii) the organization initiates organization-defined transfer or reassignment actions within organization-defined time period following the formal transfer action; (iii) the organization confirms ongoing operational need for current access authorizations; and (iv) the organization modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer. High [Test: PS-5.1 - Personnel Transfer] Not Entered [E-# OR W-#] Temperature and Humidity Controls [Test: PE-14.1 - Failure to meet the temperature and humidity controls requirements listed below High [Test: PE-14.1 - Temperature and Humidity Controls]
implementation of the system and information integrity policy and associated system and information integrity controls; and (vi) the organization disseminates formal documented system and information integrity procedures to elements within the organization having associated system and information integrity roles and responsibilities. [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A SC-1 (DHS-4.5.2.a)] [Test: - Technical Controls for FAX machines] Not Entered Failure of the components to implement and enforce technical controls for fax technology and systems (including fax machines, servers, gateways, software, and protocols) that transmit and receive sensitive information result in unsafe and ineffective communication systems, which could eventually lead to the loss of critical mission/business assets and information or to the disruption of DHS operations, functions and services. High [Test: - Technical Controls for FAX machines] Not Entered [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A [Test: Failure to meet the requirements for configuration settings listed below could lead High [Test: - Use of File Transfer
(AES) algorithms with at least 256 bit encryption that has been validated under FIPS (Note: The use of triple DES [3DES] and FIPS 140-1 is no longer permitted.). (ii) NSA Type 2 or Type 1 encryption. [E-# OR W-#] Identification and Authentication Policy and Procedures [NIST 800-53 w/ DHS IA-1 [Test: - PIV Credentials] Not Entered Failure to upgrade the existing physical and logical access control systems to use PIV credentials could weaken the overall security posture of the system due to lack of compliance to known standards and policies. High [Test: - PIV Credentials] Not Entered [E-# OR W-#] Security Categorization [NIST 800-53 w/ DHS RA-2 (DHS-3.14.2.e)] [Test: - Confidentiality for Privacy Systems] Not Entered Failure to ensure that the confidentiality security object for Privacy Sensitive Systems are assigned an impact level of moderate or higher could result in ineffective controls and increased information security risks. High [Test: - Confidentiality for Privacy Systems] Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS CA-1 (DHS-3.9.m)] [Test: - Use of IACS for Security Authorization] Not Entered Failure to ensure that all DHS systems are authorized using the approved automated IACS tools by the DHS CISO could result in a weak security stance of the organization due to security threats that may not have been addressed accordingly or completely by High [Test: - Use of IACS for Security Authorization] Not Entered
[NIST 800-53 w/ DHS 4300A SC-15 (DHS-4.5.3.a)] [Test: - Video Teleconference Protections] Not Entered that only authorized individuals are able to participate in each videoconference could allow the disclosure of critical DHS information. Teleconference Protections] Not Entered [E-# OR W-#] Malicious Code Protection [NIST 800-53 w/ DHS 4300A SI-3 [Test: - Email Monitoring for Malware] Not Entered Failure to ensure that DHS gateway Steward provides email monitoring for malware activity at the gateway could result in difficulty in audit and in investigation if an intrusion occurs. High [Test: - Monitoring for Malware] Not Entered [E-# OR W-#] Use of Cryptography [NIST 800-53 w/ DHS 4300A SC-13 (DHS-5.7.d)] [Test: - Cryptography Requirements] Not Entered Failure to ensure that components use only cryptographic modules that meet the requirements set in Section 5.5, Cryptography could lead to the DHS to face litigations because of offenses related to non-compliance of these premises. High [Test: - Cryptography Requirements] Not Entered [E-# OR W-#] Identification and Authentication Policy and Procedures [NIST 800-53 w/ DHS 4300A IA-1 [Test: - Online Transactions] Not Entered Failure to apply requirements for systems that allow online transactions could allow the system to become vulnerable to external attacks or unauthorized access. Data availability and/or integrity can be affected. High [Test: - Online Transactions] Not Entered
[E-# OR W-#] Identification and Authentication Users) [NIST w/ DHS 4300A IA-8 (2)] [Test: IA-8(2).1 - Acceptance Of Credentials] Not Entered Failure to ensure that the organization uses only third-party credentials could weaken its security posture, resulting to the ineffectiveness of the identification and authentication policy. High [Test: IA-8(2).1 - Acceptance Of Credentials] Not Entered [E-# OR W-#] Acquisitions [NIST 800-53 w/ DHS 4300A SA-4 [Test: - COTS Evaluation] Not Entered Failure to ensure that the strong preference are to the acquisition of COTS IA and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting sensitive information) that have been evaluated and validated, as appropriate, in accordance with the following listed below could leave the system more exposed to vulnerabilities, which an attacker could try to exploit using various vectors and compromise the system or the data in the system: (i) The NIST FIPS validation program. (ii) The National Security Agency (NSA)/NIST National Information Assurance Partnership (NIAP) Evaluation and Validation Program. High [Test: - COTS Evaluation] Not Entered
[E-# OR W-#] Review, Analysis, and Reporting [NIST 800-53 w/ DHS 4300A AU-6 [Test: - Audit Records for Financial Systems and PII] Not Entered Failure to conduct monthly audit reviews for financial systems or PII-hosted systems could allow unauthorized access to go unnoticed increasing the risk that unauthorized persons could gain access to sensitive information. High [Test: - Audit Records for Financial Systems and PII] Not Entered [E-# OR W-#] Configuration Settings [NIST w/ DHS CM-6 [Test: - Use of Telnet] Not Entered Failure to meet the requirements for configuration settings listed below could lead to the compromise of the system or of the data in the system: (i) the organization does not authorize Telnet connections to any DHS computer; (ii) the organization uses Secure Shell (SSH) connection protocols duly approved by the Component; and (iii) the SSH employ any of the following secure authentication methods: two factor encrypted key exchange High [Test: - Use of Telnet] Not Entered
[E-# OR W-#] Remote Access [NIST 800-53 w/ DHS 4300A AC-17 (DHS-5.4.1.b)] [Test: - Remote Access Connection Management] Not Entered Failure to meet the required remote access control policy and procedures listed below could result in a weaker security posture as a consequence of a failed audit process, the non-accountability of critical actions, and ignorance to the policy being implemented for the organization: (i) the Components centrally manage all remote access and dial-in connections to their systems; (ii) the Components ensure that remote access and approved dial-in capabilities provide the following access control mechanisms for sensitive information throughout transmission: strong authentication two-factor authentication audit capabilities protection High [Test: - Remote Access Connection Management] Not Entered
(ii) two-factor authentication is only allowed during remote access if one of the factors is provided by a device separate from the computer gaining access; (iv) any two-factor authentication is on Department-controlled certificates or hardware tokens issued directly to each authorized user; and (v) remote access solutions comply with the encryption requirements of FIPS 140-2, Security Requirements for Cryptographic Modules. [E-# OR W-#] Secure Name/Address Resolution Service (Recursive or Caching Resolver) [NIST 800-53 w/ DHS SC-21] [Test: SC-21.1 - Secure Name / Address Resolution Service(Recursive or Caching Resolver)] Not Entered Failure of the information system, that provides name/address resolution service for local clients, to perform data origin authentication and data integrity verification on the resolution responses it receives from authoritative sources when requested by client systems could lead to the complete compromise of the system. High [Test: SC-21.1 - Secure Name / Address Resolution Service(Recursive or Caching Resolver)] Not Entered
[E-# OR W-#] Information Output Handling and Retention [NIST 800-53 w/ DHS 4300A SI-12] [Test: SI-12.1 - Information Handling and Retention] Not Entered Failure to ensure that the organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements could result in the disclosure of critical/sensitive information or data, which could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes. High [Test: SI-12.1 - Information Handling and Retention] Not Entered [E-# OR W-#] System Use Notification [NIST 800-53 w/ DHS AC-8 [Test: - Governement Funded Office Equipment] Not Entered Failure to and/or monitor all government office equipment and DHS systems/computers using the criteria below could allow unauthorized activities (including insider threat) and other form of intrusions to go undetected. Monitoring criteria: (a) Tracking of internal and external transactions (e.g. Internet access). High [Test: - Governement Funded Office Equipment] Not Entered
environments; (ii) the Program Manager may delegate this authority to another DHS employee in writing and the authority is not delegated to contractor personnel. [E-# OR W-#] Security Authorization [NIST 800-53 w/ DHS 4300A CA-6 (DHS-3.9.h)] [Test: - DHS Security Authorization] Not Entered Failure to meet the security authorization requirements listed could lead to compromise of the system or of the data in the system: (i) the components authorize systems at Initial Operating Capability, every three (3) years after, or whenever major changes occurs; and (ii) an Authority to Operate (ATO) of six (6) months or less receives an ATO authorization period waiver from the DHS CISO before submission to the AO for the final decision. High [Test: - DHS Security Authorization] Not Entered [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 (DHS-3.7.e)] [Test: - USGCB Requirements] Not Entered Failure to meet the workstation's baseline configuration requirements listed below could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of High [Test: - Requirements] Not Entered
organization-defined frequency. [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A SC-1 (DHS-4.5.3.b)] [Test: - Transmission Controls] Not Entered Failure of the components to ensure that appropriate transmission protections, commensurate with the highest sensitivity of information to be discussed, are in place throughout any video teleconference could result in unsafe and ineffective communication systems, which could eventually lead to the loss of critical mission/business assets and information or to the disruption of DHS operations, functions and services. High [Test: - Transmission Controls] Not Entered [E-# OR W-#] Audit Review, Analysis, and Reporting [NIST 800-53 w/ DHS 4300A AU-6 [Test: - Mail Server Administration] Not Entered Failure to employ mail server administration procedures could result in the loss of the integrity of the system due to untimely detection of threats or attacks. High [Test: - Mail Server Administration] Not Entered [E-# OR W-#] Secure Name/Address Resolution Service (Authoritative Source) [NIST w/ DHS 4300A SC-20 [Test: - DHS Secure Name / Address Resolution Service] Not Entered Failure to ensure that all DHS systems connected to OneNet and operating at moderate or high level are utilized secure Name/Address resolution service provided by DHS OneNet could risk the integrity and stability of the system. High [Test: - DHS Secure Name / Address Resolution Service] Not Entered
[E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A SC-1 (DHS-5.5.3.j)] [Test: - DHS FPKI] Not Entered Failure to meet the DHS FPKI requirements listed could lead to non-compliance with the organization's policies, procedures, privacy requirements, agreements or contracts: (i) the organization ensures that every human subscriber has read, understand, and signed a “DHS PKI Human Subscriber Acknowledgement of Responsibilities” as a for receiving certificates from a DHS CA; and (ii) the organization ensures that all signed PKI Human Subscriber Agreements are maintained by the DHS PKI Registrar. High [Test: - DHS FPKI] Not Entered [E-# OR W-#] System and Services Acquisition Policy and Procedures [NIST 800-53 w/ DHS 4300A SA-1 (DHS-3.1.g)] [Test: - DHS Enterprise Architecture and Security Architecture] Not Entered Failure of the component CISOs /ISSMs to ensure that their information systems comply with the DHS Enterprise Architecture (EA) Technical Reference model (TRM) and Security Architecture (SA) or maintain a waiver, approved by the DHS CIO/CISO could result in the acquisition of a system/service High [Test: - DHS Enterprise Architecture and Security Architecture] Not Entered
Software] Not Entered disclosure of critical DHS information. Not Entered [E-# OR W-#] Contingency Planning Policy and Procedures [NIST 800-53 w/ DHS CP-1 [Test: - DHS Contingency Guidance] Not Entered Failure to ensure contingency capabilities for DHS systems could result in the continued operation of the system, risking further loss or damage, or the removal of the system, causing functional outage for all authorized users. High [Test: - DHS Contingency Guidance] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (12)] [Test: IA-2(12).1 - Acceptance Of PIV Credentials] Not Entered Failure to meet the requirements of accepting PIV credentials listed below could result in providing any account access to critical or sensitive information: (i) the information system accepts and electronically verifies Personal Identity Verification (PIV) credentials; (ii) the organization implements logical access control systems (LACS) and physical access control systems (PACS); and, (iii) the organization conforms to federal requirements when enabling agency-wide use of PIV credentials. High [Test: IA-2(12).1 - Acceptance Of PIV Credentials] Not Entered [E-# OR W-#] Cryptographic Key Establishment and Failure to ensure that a human sponsor represented each High [Test: - Authorized
Support System (GSS) after transition; (iii) the organization requires an ISA whenever there is a difference in security categorizations for confidentiality, integrity and availability between systems or when systems do not share the same security policies; and, (iv) the organization assigns the Authorizing Officer to sign the ISA. [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 (DHS-3.7.f)] [Test: - Compliance] Not Entered Failure to monitor USGCB (or DHS-approved USGCB variant) compliance using a (NIST)-validated Security Content Automation Protocol (SCAP) tool could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of systems that need configuration updates. High [Test: - Compliance] Not Entered [E-# OR W-#] Identification and Authentication Users) [NIST [Test: IA-8(3).1 - Use Of Products] Failure to ensure that the organization employs only FICAM-approved information system components to accept third-party credentials could High [Test: IA-8(3).1 - Use Of Products] Not Entered
w/ DHS 4300A IA-8 (3)] Not Entered result in the loss of system integrity. [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS SC-1 (DHS-4.4.1.a)] [Test: - Private Branch Exchange(PBX) Protections] Not Entered Failure of the components to provide adequate physical and information security for all DHS-owned Private Branch Exchanges (PBX) could result in the inability of the key organization personnel to respond properly to an incident in a timely manner, which could lead to the disruption of critical mission/business functions, operations, and processes. High [Test: - Private Branch Exchange(PBX) Protections] Not Entered [E-# OR W-#] Acquisitions [NIST 800-53 w/ DHS 4300A SA-4 (10)] [Test: SA-4(10).1 - Use Of Approved Piv Products] Not Entered Failure to ensure that the organization employs only information technology products on the FIPS products list for Personal Identity Verification (PIV) capability implemented within organizational information systems could lead to the compromise of the system or of the data in the system. High [Test: SA-4(10).1 - Use Of Approved Piv Products] Not Entered [E-# OR W-#] Security Planning Policy and Procedures [NIST 800-53 w/ DHS 4300A PL-1 [Test: - Sensitive PII] Failure to ensure that systems that, as part of routine business, remove Sensitive PII in the form of a CRE, e.g., routine system-to-system transmissions of data (routine CREs) are High [Test: - Sensitive PII] Not Entered
organization operations, functions and services. [E-# OR W-#] Information System Connections [NIST 800-53 w/ DHS 4300A CA-3 [Test: - DHS OneNet Interconnections] Not Entered Failure to meet the security requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization maintains Interconnection Security Agreements (ISAs) for all connections between systems that do not have the same security policy; and, (ii) the ISAs are authorized by the DHS OneNet Authorizing Officer. High [Test: - DHS OneNet Interconnections] Not Entered [E-# OR W-#] System and Services Acquisition Policy and Procedures [NIST 800-53 w/ DHS 4300A SA-1 (DHS-3.3.b)] [Test: - Contractor Information System Services and Operations] Not Entered Failure to ensure that the contractor information system services and operations adhere to all applicable DHS information security policies could result in the loss of system integrity and stability, which could lead to the disclosure of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes. High [Test: - Contractor Information System Services and Operations] Not Entered [E-# OR W-#] Position Categorization Failure to meet the position risk designation requirements High [Test: PS-2.1 - Position Risk
[NIST 800-53 w/ DHS PS-2] [Test: PS-2.1 - Position Risk Designation] Not Entered indicated below could result in data compromise: (i) the organization assigns a risk designation to all positions within the organization; (ii) the organization establishes a criteria for individuals filling organizational positions; and (iii) the organization defines the frequency of risk designation reviews and updates for organizational positions. Designation] Not Entered [E-# OR W-#] System and Information Integrity Policy and Procedures [NIST 800-53 w/ DHS SI-1 (DHS-5.4.5.c)] [Test: - Use of Executable Code] Not Entered Failure of the components to ensure that all executable code, including mobile code (e.g., ActiveX, JavaScript), is reviewed and approved by the Program Manager prior to the code being allowed to execute within the DHS environment could result in the inability to detect threats/vulnerabilities and exploits identified with and inherent in malicious codes enabling any determined attacker or user to gain unauthorized access to the system, which could eventually lead to the loss of sensitive information or to the disruption High [Test: - Use of Executable Code] Not Entered
existing processes. (iii) Assessment is categorized in the FISMA inventory as either a major application, minor application or subsystem. [E-# OR W-#] Contingency Plan Testing and Exercises [NIST 800-53 w/ DHS 4300A CP-4] [Test: CP-4.1 - Contingency Plan Testing] Not Entered Failure to meet the contingency plan testing and exercises requirements indicated below could lead to the unavailability of critical system resources and data due to the inability to restore the system or the data in a timely manner: (i) the organization defines the contingency plan tests and/or exercises to be conducted; (ii) the organization defines the frequency of contingency plan tests and/or exercises; (iii) the organization tests/exercises the contingency plan using organization-defined tests/exercises in accordance with organization-defined frequency; and (iv) the organization reviews the contingency plan test/exercise results and takes corrective actions. High [Test: CP-4.1 - Contingency Plan Testing] Not Entered [E-# OR W-#] Information System Connections [NIST Failure to meet the security requirements listed below High [Test: CA-3.1 - System
Not Entered unauthorized access to the system or data and could risk the loss of critical DHS assets. [E-# OR W-#] Use of Cryptography [NIST 800-53 w/ DHS 4300A SC-13 (DHS-5.4.6.k)] [Test: - Unencrytped Email Usage] Not Entered Failure to ensure that the information sent outside the dhs.gov domain is encrypted could allow an attacker or a malicious user to perform information flooding types of denial of service attacks, which could lead to the compromise of the system or of the data in the system. High [Test: - Unencrytped Email Usage] Not Entered [E-# OR W-#] Least Functionality [NIST 800-53 w/ DHS 4300A CM-7 (DHS-5.4.5.f)] [Test: - Remote Desktop Connections] Not Entered Failure to meet the requirements for configuration settings listed below could lead to the compromise of the system or of the data in the system: (i) the organization does not authorize Remote Desktop connections (e.g. Microsoft's Remote Desktop Protocol) to any DHS computer without using secure authentication tools; and (ii) the organization, upon authorizing RDP connections to any DHS computer, uses any High [Test: - Remote Desktop Connections] Not Entered
information and the information system. [E-# OR W-#] Cryptographic Key Establishment and Management [NIST 800-53 w/ DHS 4300A SC-12 (DHS-5.5.3.a)] [Test: - DHS FPKI Human Subscriber] Not Entered Failure to ensure that a single public/private key pair is not used by a human subscriber for both encryption and digital signature could lead to the disclosure of critical DHS information/data. High [Test: - DHS FPKI Subscriber] Not Entered [E-# OR W-#] Information System Connections [NIST 800-53 w/ DHS CA-3 [Test: - DHS Interconnections] Not Entered Failure to meet any of the requirements from Section 5.4.3 could lead to compromise of the system or of the data in the system. High [Test: - DHS Interconnections] Not Entered [E-# OR W-#] Access Records [NIST 800-53 w/ DHS PE-8] [Test: PE-8.1 - Visitor Access Records] Not Entered Failure to meet the visitor access records requirements listed below could lead to the inadvertent disclosure of information: (i) the organization maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible); and (ii) the organization defines the frequency to review visitor access records. High [Test: PE-8.1 - Visitor Access Records] Not Entered
[E-# OR W-#] Rules of Behavior [NIST 800-53 w/ DHS 4300A PL-4 (DHS-4.8.3.a)] [Test: - Personally Owned Equipment] Not Entered Failure to ensure that personally owned equipment and software are used to process, access, or store sensitive information with the written prior approval of the AO could allow unauthorized user from executing critical transactions in DHS that can change application functionality. High [Test: - Personally Owned Equipment] Not Entered [E-# OR W-#] Least Functionality [NIST 800-53 w/ DHS 4300A CM-7 (DHS-4.8.6.a)] [Test: - Wireless for Peripheral Equipment] Not Entered Failure to disable wireless capabilities of any peripheral equipment when connected to a DHS network or other IS containing sensitive data may result in unauthorized personnel gaining access and compromising or corrupting data. High [Test: - Wireless for Peripheral Equipment] Not Entered [E-# OR W-#] Identification and Authentication Policy and Procedures [NIST 800-53 w/ DHS 4300A IA-1 [Test: - Not Entered Failure to meet the identification and authentication requirements listed could weaken the overall security posture of the system due to lack of compliance to known standards and policies: (i) the components implement the necessary guidelines for requirements; and High [Test: - Not Entered
800-53 w/ DHS 4300A IA-1 Credentials] Not Entered security posture of the system due to lack of compliance to known standards and policies. Not Entered [E-# OR W-#] Security Assessment and Authorization Policies and Procedures [NIST 800-53 w/ DHS 4300A CA-1 [Test: - Usage of Public Cloud Service Provider] Not Entered Failure to provide the proper documentation to the FedRAMP PMO regarding the existence of all DHS cloud services hosted in public CSPs could weaken the overall security posture of the system. High [Test: - Usage of Public Cloud Service Provider] Not Entered [E-# OR W-#] Continuous Monitoring [NIST 800-53 w/ DHS 4300A CA-7 [Test: - AO Notification on Disabling Security Features] Not Entered Failure to immediately notify AOs when any security features are disabled in response to time-sensitive, mission-critical incidents render the security controls useless and outdated when examining recent or latest threat information and emerging vulnerabilities. High [Test: - AO Notification on Disabling Security Features] Not Entered [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 [Test: - Permitted Protocols and Services for Component PEPs] Not Entered Failure to meet the requirements listed below could lead to an attacker or a malicious user gaining unauthorized access to the system or data and could risk the loss of critical DHS assets. (i) components determined protocols and services permitted through their Component-level PEPs. High [Test: - Permitted Protocols and Services for Component PEPs] Not Entered
[E-# OR W-#] Identification and Authentication (Organizational [NIST 800-53 w/ DHS 4300A (1)] [Test: IA-2(1).1 - Network Access To Privileged Accounts] Not Entered Failure to ensure that the information system uses multifactor authentication for network access to privileged accounts result in ineffective identification and authentication policy, which could lead to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data. High [Test: IA-2(1).1 - Network Access To Privileged Accounts] Not Entered [E-# OR W-#] Remote Access [NIST 800-53 w/ DHS AC-17 (DHS-5.4.1.c)] [Test: - Remote Access of PII] Not Entered Failure to employ strong authentication protocols to facilitate the monitoring and control of remote access methods for PII could result in a system breach through remote access attack vectors that could eventually lead to disclosure or compromise of high-level information. High [Test: - Remote Access of PII] Not Entered [E-# OR W-#] System and Information Integrity Policy and Procedures [NIST 800-53 w/ DHS SI-1 (DHS-5.4.6.h)] [Test: - Monitoring for Spam] Not Entered Failure to ensure that the DHS gateway Steward provides email monitoring for spam at the gateway could result in the ineffective remediation strategy, which could eventually lead to the loss of sensitive information or to the disruption of critical DHS functions, services, and operations/processes. High [Test: - Email Monitoring for Spam] Not Entered
[E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 [Test: - Network Printers, Copiers, and Facsimile Administration] Not Entered Failure to ensure that the organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to network printers, copiers, and facsimile machines could lead to the compromise of the system or of the data in the system. High [Test: - Network Printers, Copiers, and Facsimile Administration] Not Entered [E-# OR W-#] Denial-of-Service Protection [NIST 800-53 w/ DHS SC-5 [Test: - Denial of Service countermeasures] Not Entered Failure of the components to identify the countermeasures to denial-of-service attacks and complete a risk based evaluation prior to approving the use of a wireless PED could result in non-secure system that lacks stability and integrity causing the unavailability of the system or the data in the system to authorized users. High [Test: - Denial of Service countermeasures] Not Entered [E-# OR W-#] Plan of Action and Milestones [NIST 800-53 w/ DHS 4300A CA-5 [Test: - DHS POA&M Requirements] Not Entered Failure to meet the plan of action and milestones requirements listed exposes the system to security threats due to security holes that could have been patched in a timely manner, which could eventually lead to the compromise of the system or of the data in the system: (i) the organization develops a High [Test: - DHS POA&M Requirements] Not Entered
investigations and clearances, and facility security. [E-# OR W-#] Identification and Authentication Users) [NIST w/ DHS 4300A IA-8 (4)] [Test: IA-8(4).1 - Use Of Ficam-Issued Profiles] Not Entered Failure to ensure that the information system conforms to FICAM-issued profiles could weaken its security posture, resulting to the ineffectiveness of the identification and authentication policy. High [Test: IA-8(4).1 - Use Of Profiles] Not Entered [E-# OR W-#] System and Communications Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A SC-1 (DHS-5.7.a)] [Test: - Information Assurance Considerations] Not Entered Failure to meet the requirements could lead to ineffectively remediate information security weaknesses: (i) Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmits sensitive or security information. (ii) IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial (COTS) IA and IT products. (iii) The products are provided for the availability of systems. (iv) The products ensured the integrity and confidentiality of information and the High [Test: - Information Assurance Considerations] Not Entered
OneNet, DHS networks, or DHS mission systems to the Internet or to extranets are occurring through DHS Trusted Internet Connection (TIC) PEPs. (ii) The PSTN is not connected to OneNet at any time. [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 [Test: - FAX Server Configuration] Not Entered Failure to configure secure incoming lines for fax servers may result in data being intercepted or compromised. High [Test: - FAX Server Configuration] Not Entered [E-# OR W-#] Rules of Behavior [NIST 800-53 w/ DHS 4300A PL-4 (DHS-4.8.2.b)] [Test: - Laptop Power Down] Not Entered Failure to ensure that the computers are powered down when not in use (due to volatile memory vulnerabilities) lead to computer resources damaged or destroyed. High [Test: - Laptop Down] Not Entered [E-# OR W-#] Media Protection Policy and Procedures [NIST 800-53 w/ DHS 4300A MP-1 [Test: - PII Remote Access] Not Entered Failure to meet the media protection policy and procedures requirements indicated below could lead to the compromise of the system or of the data in the system: (i) remote access of PII does not permit the download and remote storage of information unless the requirements for the High [Test: - PII Remote Access] Not Entered
use of removable media with sensitive information have been addressed; (ii) all downloads follow the concept of least privilege and are documented with the Security Plan. [E-# OR W-#] Configuration Settings [NIST w/ DHS 4300A CM-6 (DHS-4.12.j)] [Test: - Multifunction Device Configuration] Not Entered Failure to disable the inbound dial-in capabilities of any multifunction device when connected to a DHS network or other IS containing sensitive data may result in unauthorized personnel gaining access and compromising or corrupting data. High [Test: - Multifunction Device Configuration] Not Entered [E-# OR W-#] Use of Cryptography [NIST 800-53 w/ DHS 4300A SC-13 (DHS-5.5.2.v)] [Test: - Cryptography for Commerical Products] Not Entered Failure to ensure that the commercial products used by DHS and applications developed by DHS that enable the use of PKI are at a minimum support the following cryptographic algorithms and associated key sizes could cause the organization to face litigations because of offenses to non-compliance of these premises: SHA 1 SHA 256 High [Test: - Cryptography for Commerical Products] Not Entered
approval by the DHS PKIPA are obtained. [E-# OR W-#] Identification and Authentication Users) [NIST w/ DHS 4300A IA-8 (DHS-1.5.4.c)] [Test: - Foreign Nationals] Not Entered Failure to maitain additional compensating controls for foreign nationals could leave the system vulnerable to unauthorized access and intrusion. High [Test: - Foreign Nationals] Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 [Test: - ISVM Compliance] Not Entered Failure of the components to manage systems to reduce vulnerabilities through vulnerability testing and management, promptly installing patches, and eliminating or disabling unnecessary services could result in weaker security posture, which could lead to unauthorized disclosure of more information. High [Test: - ISVM Compliance] Not Entered [E-# OR W-#] Cryptographic Key Establishment and Management [NIST 800-53 w/ DHS 4300A SC-12 (DHS-5.5.3.b)] [Test: - PKI for NPE] Not Entered Failure to ensure that a single public/private key pair is not used by an NPE for both encryption and digital signature, whenever their separate use is supported by the protocols native to the NPE could lead to the disclosure of critical DHS information/data. High [Test: - PKI for NPE] Not Entered [E-# OR W-#] Cryptographic Key Establishment and Management [NIST [Test: Failure to meet the subscriber use of private key requirements listed below could lead to the High [Test: - Subscriber Use of Private Key]
organization-defined specifications. [E-# OR W-#] Configuration Change Control [NIST 800-53 w/ DHS 4300A CM-3 (2)] [Test: CM-3(2).1 - Test / Validate / Document Changes] Not Entered Failure to ensure that the organization tests, validates, and documents changes to the information system before implementing the changes on the operational system could leave the system vulnerable to unexpected crashes or instability in operation. High [Test: CM-3(2).1 - Test / Validate / Document Changes] Not Entered [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS 4300A CM-2 (7)] [Test: CM-2(7).1 - Configure Systems, Components, Or Devices For Areas] Not Entered Failure to meet the baseline configuration requirements listed below could result in a system that is not properly configured or with a weak security stance, which could lead to the compromise of data or the system itself: (i) the organization issues information systems, system components, or devices with secured configurations to individuals travelling to locations that the organization deems to be of significant risk; and, (ii) the organization applies security safeguards to the devices when the individuals return. High [Test: CM-2(7).1 - Configure Systems, Components, Or Devices For Areas] Not Entered
[E-# OR W-#] Session Lock [NIST 800-53 w/ DHS 4300A AC-11] [Test: AC-11.1 - Session Lock] Not Entered Failure to meet session lock requirements indicated below could enable an attacker to try and break into the system by hijacking the idle session: (i) the organization defines the time period of user inactivity after which the information system initiates a session lock; and, (ii) the information system retains the session lock until the user reestablishes access using established identification and authentication procedures. High [Test: AC-11.1 - Session Lock] Not Entered [E-# OR W-#] Software and Information Integrity [NIST 800-53 w/ DHS 4300A SI-7 (5)] [Test: SI-7(5).1 - Automated Response To Integrity Violations] Not Entered Failure to ensure that the information system automatically the information system down, restarts the information system, or implements security safeguards when integrity violations are discovered could result in the untimely remediation of discrepancies on/of information system functionality, which could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, High [Test: SI-7(5).1 - Automated Response To Integrity Violations] Not Entered
services, and operations/processes. [E-# OR W-#] Protection of Information at Rest [NIST 800-53 w/ DHS 4300A SC-28] [Test: SC-28.1 - Protection of Information at Rest] Not Entered Failure to ensure that the information system protects the confidentiality and integrity of information at rest could risk the disclosure of sensitive information or the disruption of critical mission/business functions, services, and operations/processes. High [Test: SC-28.1 - Protection of Information at Rest] Not Entered [E-# OR W-#] Configuration Management Plan [NIST 800-53 w/ DHS 4300A CM-9] [Test: CM-9.1 - Configuration Management Plan] Not Entered Failure to meet the configuration management plan requirements listed below could weaken the overall security posture of the system: (i) the organization develops, documents, and implements a configuration management plan for the information system that: addresses responsibilities, and configuration management processes and procedures; defines the configuration items for the information system and when in the system development life cycle High [Test: CM-9.1 - Configuration Management Plan] Not Entered
[E-# OR W-#] Security Assessments [NIST 800-53 w/ DHS 4300A CA-2 (2)] [Test: CA-2(2).1 - Specialized Assessments] Not Entered [Test: CA-2.2 - Security Assessments] Not Entered Failure to meet the security assessments requirements listed could weaken the overall security posture of the system: (i) the organization defines the frequency of assessing the security controls in the information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system; (ii) the organization assesses the security controls in the information system at the organization-defined frequency; (iii) the organization produces a security assessment report that documents the results of the security control assessment; and (iv) the results of the security control assessment are provided, in writing, to the authorizing official or authorizing official designated representative. High [Test: CA-2(2).1 - Specialized Assessments] Not Entered [Test: CA-2.2 - Security Assessments] Not Entered
techniques established for each form of testing. [E-# OR W-#] Protection of Information at Rest [NIST 800-53 w/ DHS 4300A SC-28 (DHS-5.2.g)] [Test: - DHS Data at Rest Requirements] Not Entered Failure of the components and programs to ensure that all data-at-rest, particularly in cloud or other virtual environments, preserves its identification and access requirements (anyone with access to data storage containing more than one type of information must have specific access authorization for every type of data in the data storage) could risk the disclosure of sensitive information or the disruption of critical mission/business functions, services, and operations/processes. High [Test: - DHS Data at Rest Requirements] Not Entered [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS CM-2 (DHS-4.12.b)] [Test: - Network Printers and Facsimile Machines] Not Entered Failure of the organization to employ automated mechanisms to ensure network printers and facsimile machines are with the latest software version/firmware could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of systems that need configuration updates. High [Test: - Network Printers and Facsimile Machines] Not Entered
[E-# OR W-#] Alternate Processing Site [NIST 800-53 w/ DHS 4300A CP-7] [Test: CP-7.1 - Alternate Processing Site] Not Entered Failure to meet the requirements for alternate processing site indicated below could lead to the interruption of business processes: (i) the organization establishes an alternate processing site; (ii) the organization defines the time period for achieving the recovery time objectives within which processing must be resumed at the alternate processing site; (iii) the organization includes necessary alternate processing site agreements to permit the resumption of information system operations for essential missions and business functions within time period; and (iv) the equipment and supplies required to resume operations are available at the alternate site or contracts are in place to support delivery to the site in time to support the organization-defined time period for resumption. High [Test: CP-7.1 - Alternate Processing Site] Not Entered [E-# OR W-#] Security Functionality Verification [NIST [Test: SI-6.1 - Failure to meet the requirements for security functionality verification listed High [Test: SI-6.1 - Security Function Verification]
800-53 w/ DHS 4300A SI-6] Security Function Verification] Not Entered below could leave the system more exposed to vulnerabilities, which an attacker could try to exploit using various vectors and compromise the system or the data in the system: (i) the organization verifies the correct operation of organization-defined security functions; (ii) the organization performs this verification system transitional states, upon command by user with appropriate privilege or organization-defined frequency; (iii) the organization notifies organization-defined personnel or roles of failed automated security tests; and (iv) the organization shuts the information system down, restarts the information system or organization-defined alternative action(s) when anomalies are discovered. Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2 (1)] [Test: AC-2(1).1 - Automated System Failure of the organization to employ automated mechanisms to support information system account management functions High [Test: AC-2(1).1 - Automated System Account Management]
document proposed changes to the information system; notify designated approval authorities; highlight approvals that have not been received by the time period; inhibit change designated approvals are received; and document completed changes to the information system. [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 (18)] [Test: SC-7(18).1 - Fail Secure] Not Entered Failure to ensure that the information system fails securely in the event of an operational failure of a boundary protection device could allow a hacker to gain control over an application. High [Test: SC-7(18).1 - Fail Secure] Not Entered [E-# OR W-#] Audit Reduction and Report Generation [NIST 800-53 w/ DHS 4300A AU-7 (1)] [Test: AU-7(1).1 - Automatic Processing] Not Entered Failure of the information system to provide the capability to automatically process audit records for events of interest based upon selectable event criteria could lead to the inability to track in a timely manner any attack on the system or data. High [Test: AU-7(1).1 - Automatic Processing] Not Entered
[E-# OR W-#] Concurrent Session Control [NIST w/ DHS 4300A AC-10] [Test: AC-10.1 - Concurrent Session Control] Not Entered Failure to meet the concurrent session control requirements listed below could enable an attacker to try and break into the system by hijacking the session and cause damage to the information system: (i) the organization defines the maximum number of concurrent sessions to be allowed for each system account; and (ii) the information system limits the number of concurrent sessions for each system account to the number of sessions. High [Test: AC-10.1 - Concurrent Session Control] Not Entered [E-# OR W-#] Spam Protection [NIST 800-53 w/ DHS 4300A SI-8 (2)] [Test: SI-8(2).1 - Automatic Updates] Not Entered Failure of the information system to automatically update spam protection mechanisms leaves the organization with an ineffective information system, could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes. High [Test: SI-8(2).1 - Automatic Updates] Not Entered [E-# OR W-#] External Information System Services [NIST [Test: SA-9(2).1 - Identification Of Failure to ensure that the organization requires providers of organization-defined external information system High [Test: SA-9(2).1 - Identification Of Functions / Ports / Protocols / Services]
w/ DHS (2)] Functions / Ports / Protocols / Services] Not Entered services to identify the functions, ports, protocols, and other services required for the use of such services could eventually lead to the loss of critical mission/business assets or to the disruption of organization operations, functions and services. Not Entered [E-# OR W-#] Incident Response Training [NIST 800-53 w/ DHS 4300A IR-2 (2)] [Test: IR-2(2).1 - Automated Training Environments] Not Entered Failure of the organization to employ automated incident response training mechanisms to provide a more thorough and realistic training environment could result in the inability to respond properly to an incident, which could lead to the disruption of critical mission/business functions, operations, and processes. High [Test: IR-2(2).1 - Automated Training Environments] Not Entered [E-# OR W-#] Power Equipment and Power Cabling [NIST 800-53 w/ DHS 4300A PE-9] [Test: PE-9.1 - Power Equipment and Cabling] Not Entered Failure of the organization to protect power equipment and power cabling for the information system from damage and destruction could cause the unavailability of several system functionalities or information contained in the system. High [Test: PE-9.1 - Power Equipment and Cabling] Not Entered [E-# OR W-#] Services [NIST 800-53 w/ DHS CP-8] [Test: CP-8.1 - Telecommunications Failure to meet the telecommunication services requirements listed below could affect the timely High [Test: CP-8.1 - Telecommunications Services]
[E-# OR W-#] Information System Component Inventory [NIST 800-53 w/ DHS 4300A CM-8 (4)] [Test: CM-8(4).1 - Accountability Information] Not Entered Failure ensure that the organization includes in property accountability information for information system components, a means for identifying by name, position, or role, individuals responsible for administering those components could allow difficulty in tracking personnel responsible for making faulty configurations that could affect the system functionality negatively. High [Test: CM-8(4).1 - Accountability Information] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (8)] [Test: IA-2(8).1 - Network Access To Privileged Accounts - Replay Resistant] Not Entered Failure to meet the identification and authentication requirements listed below could result in providing any account access to critical or sensitive information: (i) the organization defines the replay-resistant authentication mechanisms to be used for network access to privileged accounts; and (ii) the information system uses the organization-defined replay-resistant authentication mechanisms for network access to privileged accounts. High [Test: IA-2(8).1 - Network Access To Privileged Accounts - Replay Resistant] Not Entered
(i) the information system automatically audits: account creation; modification; disabling; and termination actions; and (ii) the information system notifies, as required, appropriate individuals. [E-# OR W-#] Fire Protection [NIST 800-53 w/ DHS 4300A PE-13 (1)] [Test: PE-13(1).1 - Detection Devices / Systems] Not Entered Failure to ensure that the organization employs fire detection devices/systems for the information system that activate automatically and notify organization-defined personnel and emergency responders in the event of a fire could lead to accidents or personnel/employee injury due to the lack of fire detection devices/systems or due to untimely notification. High [Test: PE-13(1).1 - Detection Devices / Systems] Not Entered [E-# OR W-#] Voice Over Internet Protocol [NIST w/ DHS 4300A SC-19] [Test: SC-19.1 - Over Internet Protocol] Not Entered Failure to meet the requirements for voice over internet protocol listed below could result in information disclosure: (i) the organization establishes High [Test: SC-19.1 - Voice Over Internet Protocol] Not Entered
sanitized using approved equipment, techniques, and procedures. [E-# OR W-#] Alternate Storage Site [NIST 800-53 w/ DHS 4300A [Test: CP-6.1 - Alternate Storage Site] Not Entered Failure to meet the alternate storage site requirements listed below could lead to the untimely recovery or restoration of system or of data: (i) the organization establishes an alternate storage site; and (ii) the organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information. High [Test: CP-6.1 - Alternate Storage Site] Not Entered [E-# OR W-#] Developer-Provided Training [NIST 800-53 w/ DHS 4300A SA-16] [Test: SA-16.1 - Developer-Provided Training] Not Entered Failure to ensure that the organization requires the developer of the information system, system component, or information system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms could result in the inability to respond properly to an incident, leading to the disruption of critical mission/business functions, operations, and processes. High [Test: SA-16.1 - Developer-Provided Training] Not Entered
[E-# OR W-#] Information System Component Inventory [NIST 800-53 w/ DHS 4300A CM-8 (3)] [Test: CM-8(3).1 - Automated Unauthorized Component Detection] Not Entered Failure to meet the information system component inventory requirements listed below could eventually lead to the loss of critical resources due to the absence of tracking process that could detect missing critical components in a timely fashion: (i) the organization defines the frequency of employing automated mechanisms to detect the addition of unauthorized components/devices into the information system; (ii) the organization employs automated mechanisms, in accordance with the organization-defined frequency, to detect the addition of unauthorized components/devices into the information system; and (iii) the organization disables network access by such components/devices or notifies designated organizational officials. High [Test: CM-8(3).1 - Automated Unauthorized Component Detection] Not Entered [E-# OR W-#] Least Privilege [NIST 800-53 w/ [Test: AC-6(2).1 - Failure to meet the least privilege requirements listed below could leave the system High [Test: AC-6(2).1 - Non-Privileged Access For
DHS 4300A AC-6 (2)] Non-Privileged Access For Nonsecurity Functions] Not Entered vulnerable to unauthorized access: (i) the organization defines the security functions or information to which users of information system accounts, or roles, have access; (ii) the organization requires that users of information system accounts, or roles, with access to organization-defined security functions or information, use accounts, or roles, when accessing other system functions; and, (iii) the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to security functions or security-relevant information, when accessing other system functions. Nonsecurity Functions] Not Entered [E-# OR W-#] Access Restrictions for Change [NIST 800-53 w/ DHS 4300A CM-5 (1)] [Test: CM-5(1).1 - Automated Access Enforcement / Auditing] Not Entered Failure of the organization to employ automated mechanisms to enforce access restrictions and support auditing of the enforcement actions could allow any user to effect system wide modification without being detected in a timely High [Test: CM-5(1).1 - Automated Access Enforcement / Auditing] Not Entered
[E-# OR W-#] Alternate Processing Site [NIST 800-53 w/ DHS 4300A CP-7 (3)] [Test: CP-7(3).1 - Priority Of Service] Not Entered Failure to ensure that the organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organization's availability requirements could result in the system or data being unavailable when needed; or, could possibly lead to the discontinuation of the entire business operations/processes. High [Test: CP-7(3).1 - Priority Of Service] Not Entered [E-# OR W-#] Time Stamps [NIST 800-53 w/ DHS AU-8 (1)] [Test: AU-8(1).1 - Synchronization With Authoritative Time Source] Not Entered Failure to meet the time requirements listed below could result in the untimely tracking or detection of attack on the system, which could lead to the complete compromise of the system or of the data in the system: (i) the organization defines the frequency of internal clock synchronization for the information system; (ii) the organization defines the authoritative time source for internal clock synchronization; and (iii) the organization synchronizes internal information system clocks with the organization-defined High [Test: AU-8(1).1 - Synchronization With Authoritative Time Source] Not Entered
Not Entered have no identifiable owner could leave the system vulnerable to data extraction or corruption depending on the mode of attack used. [E-# OR W-#] Contingency Plan [NIST 800-53 w/ DHS 4300A CP-2 (2)] [Test: CP-2(2).1 - Capacity Planning] Not Entered Failure to ensure that the organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations could prevent a possible overload of security rules and redundancy of policies that will be placed in effect. High [Test: CP-2(2).1 - Capacity Planning] Not Entered [E-# OR W-#] Development Process, Standards, and [NIST 800-53 w/ DHS 4300A SA-15] [Test: SA-15.1 - Development Process, Standards, and Not Entered Failure to meet the development process, standards, and tools requirements indicated below could result in the acquisition of inherently unsafe/non-secure systems that would expose the organization to other exploits and threats/vulnerabilities, which could eventually lead to the loss of critical mission/business assets or to the disruption of organization operations, functions and services: High [Test: SA-15.1 - Development Process, Standards, and Tools] Not Entered
and employed can satisfy organization security requirements. [E-# OR W-#] Least Privilege [NIST 800-53 w/ DHS 4300A AC-6] [Test: AC-6.1 - Least Privilege] Not Entered Failure to ensure that the organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions could result in the non-completion of critical and required tasks by users of the information system. High [Test: AC-6.1 - Privilege] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (3)] [Test: IA-2(3).1 - Local Access To Privileged Accounts] Not Entered Failure to ensure that the information system uses multifactor authentication for local access to privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(3).1 - Local Access To Privileged Accounts] Not Entered [E-# OR W-#] Collaboration and Information Sharing [NIST 800-53 w/ DHS 4300A AC-21] [Test: AC-21.1 - Information Sharing] Not Entered Failure to meet the collaboration and information sharing requirements listed below could leave essential data exposed to unauthorized access and viewing by individuals not connected to the organization: High [Test: AC-21.1 - Information Sharing] Not Entered
800-53 w/ DHS 4300A SI-7 - Embedded Passwords] Not Entered code could eventually lead to disclosure or compromise of high-level information. Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2 (5)] [Test: AC-2(5).1 - Inactivity Logout] Not Entered Failure to require to log out in accordance with the organization-defined of inactivity and/or description of when to log out could leave the system vulnerable to improper utilization of resources due to unmonitored usage times of systems and non-compliance to access restrictions that are critical to the overall durability of organizational assets. High [Test: AC-2(5).1 - Inactivity Logout] Not Entered [E-# OR W-#] Software and Information Integrity [NIST 800-53 w/ DHS 4300A SI-7] [Test: SI-7.1 - Software, Firmware, and Information Integrity] Not Entered Failure to ensure that the organization employs integrity verification to detect unauthorized changes to organization-defined software, firmware, and information could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes. High [Test: SI-7.1 - Software, Firmware, and Information Integrity] Not Entered [E-# OR W-#] Media Transport [NIST 800-53 w/ DHS 4300A MP-5] [Test: MP-5.1 - Media Transport] Failure to meet the media transport requirements listed below could lead to the compromise of the system or of High [Test: MP-5.1 - Media Transport] Not Entered
measures to be employed to protect against supply chain threats; and (ii) the organization protects against supply chain threats by employing measures as part of a comprehensive, information security strategy. [E-# OR W-#] Configuration Change Control [NIST 800-53 w/ DHS 4300A CM-3 (DHS-5.4.3.l)] [Test: - DHS Change Control Boards(CCB)] Not Entered Failure to meet the configuration change control requirements listed below could lead to the compromise of the system or of the data in the system: (i) the Control Change Board (CCB) determines the types of changes to the information system that are configuration controlled; and (ii) the CCB documents approved changes to the system, including DHS systems that interface with OneNet. High [Test: - DHS Change Control Boards(CCB)] Not Entered [E-# OR W-#] Malicious Code Protection [NIST 800-53 w/ DHS SI-3 (2)] [Test: SI-3(2).1 - Automatic Updates] Failure of the organization to automatically update malicious code protection mechanisms result in the inability to detect in a timely fashion any High [Test: SI-3(2).1 - Automatic Updates] Not Entered
(Organizational Users) [NIST w/ DHS 4300A IA-2 (2)] [Test: IA-2(2).1 - Network Access To Non-Privileged Accounts] Not Entered multifactor authentication for network access to accounts could result in the absence of personnel responsibility and accountability or in ineffective identification and authentication policy, which could lead to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data. Non-Privileged Accounts] Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2 (11)] [Test: AC-2(11).1 - Usage Conditions] Not Entered Failure to describe the specific conditions or circumstances under which information system accounts can be used could leave the system vulnerable to improper utilization of resources due to unmonitored activity of access. High [Test: AC-2(11).1 - Usage Conditions] Not Entered [E-# OR W-#] Device Identification and Authentication [NIST 800-53 w/ DHS 4300A IA-3] [Test: IA-3.1 - Device Identification and Authentication] Not Entered Failure to meet the user identification and authentication requirements listed below could lead to any attacker or malicious user gaining unauthorized access to or elevated privileges on the system or the data through specific devices that the information system could not properly identify/authorize: High [Test: IA-3.1 - Device Identification and Authentication] Not Entered
(i) the organization defines the specific and/or types of devices for which identification and authentication is required before establishing a connection to the information system; and (ii) the information system uniquely identifies and authenticates the devices before establishing a connection to the information system. [E-# OR W-#] Fail in State [NIST 800-53 w/ DHS 4300A SC-24] [Test: SC-24.1 - Fail in Known State] Not Entered Failure to ensure that the information system to a organization-defined for organization-defined types of failures preserving organization-defined system state information in failure could leave the system vulnerable to several other critical security concerns resulting from non-compliance of known standards and rules. High [Test: SC-24.1 - Fail in Known State] Not Entered [E-# OR W-#] Access Control for Mobile Devices [NIST 800-53 w/ DHS 4300A AC-19 (5)] [Test: AC-19(5).1 - Full Device / Container-Based Encryption] Not Entered Failure to employ encryption to protect the confidentiality and integrity of information on mobile devices could lead to an occurrence of unauthorized disclosure of information. High [Test: AC-19(5).1 - Full Device / Container-Based Encryption] Not Entered
[E-# OR W-#] Least Functionality [NIST 800-53 w/ DHS 4300A CM-7 (1)] [Test: CM-7(1).1 - Periodic Review] Not Entered Failure to meet the least functionality requirements listed below could allow any user to perform other functions without restrictions or, possibly, could allow any attacker to gain unauthorized access to the system or the data in the system: (i) the organization defines the frequency of information system reviews to identify and eliminate unnecessary: functions; ports; protocols; and/or services; and (ii) the organization reviews the information system in accordance with frequency to identify and eliminate unnecessary: functions; ports; protocols; and/or services. High [Test: CM-7(1).1 - Periodic Review] Not Entered
[E-# OR W-#] Security Assessments [NIST 800-53 w/ DHS 4300A CA-2 (1)] [Test: CA-2(1).1 - Independent Assessors] Not Entered Failure to ensure that the organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system could allow certain security holes to exist not discovered by internal assessment teams. High [Test: CA-2(1).1 - Independent Assessors] Not Entered [E-# OR W-#] Wireless Access [NIST 800-53 w/ DHS 4300A AC-18 (1)] [Test: AC-18(1).1 - Authentication And Encryption] Not Entered Failure of the organization to use authentication and encryption to protect wireless access to the information system could result in information disclosure by trying to intercept a session that terminates to the system if the organization uses authentication and encryption to protect wireless access to the information system. High [Test: AC-18(1).1 - Authentication And Encryption] Not Entered [E-# OR W-#] Security Function Isolation [NIST 800-53 w/ DHS 4300A SC-3] [Test: SC-3.1 - Security Function Isolation] Not Entered Failure to ensure that the information system isolates security functions from nonsecurity functions could try to exploit using various vectors and compromise the system or the data in the system High [Test: SC-3.1 - Security Function Isolation] Not Entered [E-# OR W-#] Emergency Shutoff [NIST 800-53 w/ DHS 4300A PE-10] [Test: PE-10.1 - Emergency Shutoff] Failure to meet the requirements for emergency shutoff listed below could lead to the compromise of the High [Test: PE-10.1 - Emergency Shutoff] Not Entered
(i) the organization prohibits the use of binary or code from sources with limited or no warranty and without the provision of source code; and (ii) the organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official. [E-# OR W-#] Monitoring Physical Access [NIST w/ DHS 4300A PE-6 (1)] [Test: PE-6(1).1 - Intrusion Alarms / Surveillance Equipment] Not Entered Failure to ensure that the organization monitors physical intrusion alarms and surveillance equipment could lead to the compromise of the system or to the disclosure of information. High [Test: PE-6(1).1 - Intrusion Alarms / Surveillance Equipment] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (4)] [Test: IA-2(4).1 - Local Access To Non-Privileged Accounts] Not Entered Failure to ensure that the information system uses multifactor authentication for local access to non-privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(4).1 - Access To Accounts] Not Entered [E-# OR W-#] Information Flow Enforcement [NIST 800-53 w/ DHS 4300A AC-4] [Test: AC-4.1 - Information Flow Failure of the information system to use protected processing domains result in an unsuitable, inaccurate or High [Test: AC-4.1 - Information Flow Enforcement]
Enforcement] Not Entered unreliable information flow enforcement control implementation. Not Entered [E-# OR W-#] Session Lock [NIST 800-53 w/ DHS 4300A AC-11 (1)] [Test: AC-11(1).1 - Pattern-Hiding Displays] Not Entered Failure to ensure that the information system session conceals information previously visible on the display with a publicly viewable image could leave essential data visible to personnel. High [Test: AC-11(1).1 - Pattern-Hiding Displays] Not Entered [E-# OR W-#] Mobile Code [NIST 800-53 w/ DHS SC-18] [Test: SC-18.1 - Mobile Code] Not Entered Failure to meet the mobile code requirements indicated below could leave the system more exposed to vulnerabilities, which an attacker could try to exploit using various vectors and compromise the system or the data in the system: (i) the organization defines acceptable and unacceptable mobile code and mobile code technologies; (ii) the organization establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and (iii) the organization authorizes, monitors, and controls the use of mobile code within the information system. High [Test: SC-18.1 - Mobile Code] Not Entered
[E-# OR W-#] Audit Review, Analysis, and Reporting [NIST 800-53 w/ DHS 4300A AU-6 (6)] [Test: AU-6(6).1 - Correlation With Physical Monitoring] Not Entered Failure to ensure that the organization correlates information from audit records with information obtained from monitoring physical access to enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity could prevent the proper implementation of standard audit requirements and protocols. High [Test: AU-6(6).1 - Correlation With Physical Monitoring] Not Entered [E-# OR W-#] Services [NIST 800-53 w/ DHS 4300A CP-8 (2)] [Test: CP-8(2).1 - Single Points Of Failure] Not Entered Failure of the organization to obtain alternate telecommunications services that do not share a single point of failure with primary telecommunications services could leave the system unavailable or inaccessible when either the primary or the alternate telecommunications service is down. High [Test: CP-8(2).1 - Single Points Of Failure] Not Entered [E-# OR W-#] Information System Monitoring [NIST 800-53 w/ DHS 4300A SI-4 (4)] [Test: SI-4(4).1 - Inbound And Outbound Communications Traffic] Not Entered Failure to ensure that the information system monitors inbound and outbound communications traffic organization-defined frequency for unusual or unauthorized activities or conditions could result in the inability to detect any attack on, intrusion of or unusual/unauthorized use of the High [Test: SI-4(4).1 - Inbound And Outbound Communications Traffic] Not Entered
Not Entered sensitive mission/business information due to the inappropriate or unapproved of disposal process. [E-# OR W-#] Protection of Audit Information [NIST 800-53 w/ DHS 4300A AU-9 (2)] [Test: AU-9(2).1 - Backup On Separate Physical Systems / Components] Not Entered Failure to meet the protection of audit information requirements listed below could result in the loss of integrity of the audit information or of the audit tools, which could invalidate any result of forensic investigation: (i) the organization defines the system or media for storing back up audit records that is a different system or media than the system being audited; (ii) the organization defines the frequency of information system backups of audit records; and, (iii) the information system backs up audit records, in accordance with the defined frequency, onto system or media. High [Test: AU-9(2).1 - Backup On Separate Physical Systems / Components] Not Entered [E-# OR W-#] Application Partitioning [NIST 800-53 w/ DHS 4300A SC-2] [Test: SC-2.1 - Application Failure of the information system to separate user functionality (including user interface services) from High [Test: SC-2.1 - Application Partitioning]
Partitioning] Not Entered information system management functionality could lead to the instability of the system. Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (5)] [Test: RA-5(5).1 - Privileged Access] Not Entered Failure to meet the vulnerability scanning requirement listed below could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization: (i) the organization includes privileged access authorization to organization-defined information system components identified for selected vulnerability scanning activities to facilitate more thorough scanning; and, (ii) the organization defines the list of information system components to which privileged access is authorized for selected vulnerability scanning activities. High [Test: RA-5(5).1 - Privileged Access] Not Entered [E-# OR W-#] Incident Response Training [NIST 800-53 w/ DHS IR-2 (1)] [Test: IR-2(1).1 - Simulated Events] Failure of the organization to incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations High [Test: IR-2(1).1 - Simulated Events] Not Entered
Not Entered could result in the inability to respond properly to an incident, leading to the disruption of critical mission/business functions, operations, and processes. [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (1)] [Test: RA-5(1).1 - Update Tool Capability] Not Entered Failure to ensure that the organization employs vulnerability scanning tools that have the capability to readily update the list of information system vulnerabilities scanned could lead to exploitation by attackers when users visit infected web sites. High [Test: RA-5(1).1 - Update Tool Capability] Not Entered [E-# OR W-#] Public Key Infrastructure Certificates [NIST 800-53 w/ DHS SC-17] [Test: SC-17.1 - Public Key Infrastructure Certificates] Not Entered Failure to meet the organization issues public key certificates under an organization-defined certificate policy or obtains public key certificates from an approved service provider could result in the compromise of the system or of the data in the system. High [Test: SC-17.1 - Public Key Infrastructure Certificates] Not Entered [E-# OR W-#] Information Input Validation [NIST 800-53 w/ DHS 4300A SI-10] [Test: SI-10.1 - Information Input Validation] Not Entered Failure to ensure that the information system checks the validity of information inputs could result in the loss of information system integrity and stability, which could eventually lead to the loss of organizational assets or to the High [Test: SI-10.1 - Information Input Validation] Not Entered
disruption of critical mission/business functions, services, and operations/processes. [E-# OR W-#] Cryptographic Key Establishment and Management [NIST 800-53 w/ DHS 4300A SC-12 (1)] [Test: SC-12(1).1 - Availability] Not Entered Failure to ensure that the organization maintains availability of information in the event of the loss of cryptographic keys by users could lead to the disclosure of critical mission/business information/data. High [Test: SC-12(1).1 - Availability] Not Entered [E-# OR W-#] Supply Protection [NIST 800-53 w/ DHS 4300A SA-12 (DHS-5.8.a)] [Test: - Business Impact Assessments(BIA)] Not Entered Failure to ensure that the Business Impact Assessments (BIA) are used to determine the level of risk introduced to the system by the IT supply chain and whether the IT supply chain threat introduces sufficient risk to require the implementation of countermeasures could lead to disclosure of confidentiality, integrity, and availability standard as specified by the organization's policy. High [Test: - Business Impact Assessments(BIA)] Not Entered [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS 4300A CM-2 (DHS-3.9.b)] [Test: - FIPS 199 and FIPS 200 Usage] Not Entered Failure to employ NIST-based security controls could make it difficult for the organization to determine appropriate levels of protection for information all systems. High [Test: - FIPS 199 and FIPS 200 Usage] Not Entered
[E-# OR W-#] Developer Security Architecture and Design [NIST w/ DHS 4300A SA-17] [Test: SA-17.1 - Developer Security Architecture and Design] Not Entered Failure to ensure that the organization requires the developer of the information system, system component, or information system service to produce a design specification and security architecture that indicated below could lead to instability of the system or possibly to the compromise of the system: (i) Is consistent with and supportive of the security architecture established within the enterprise architecture; (ii) Accurately and completely describes the required security functionality, and the allocation of security controls among physical and logical components; and (iii) Expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. High [Test: SA-17.1 - Developer Security Architecture and Design] Not Entered [E-# OR W-#] Handling [NIST 800-53 w/ DHS 4300A SI-11] [Test: SI-11.1 - Error Failure to meet the requirements for error handling listed below could lead to the High [Test: SI-11.1 - Handling]
the security plan for the system are enforced. [E-# OR W-#] Continuous Monitoring [NIST 800-53 w/ DHS 4300A CA-7 (1)] [Test: CA-7(1).1 - Independent Assessment] Not Entered Failure of the organization to employ an independent certification agent or certification team to monitor the security controls in the information system on an ongoing basis could render the security controls useless if there would be bias in the monitoring of the in-house agent or team. High [Test: CA-7(1).1 - Independent Assessment] Not Entered [E-# OR W-#] Content of Audit Records [NIST w/ DHS 4300A AU-3 (2)] [Test: AU-3(2).1 - Centralized Management Of Planned Audit Record Content] Not Entered Failure of the information system to provide the capability to centrally manage the content of records generated from multiple components throughout the system could lead to the untimely detection of any attack on the system: (i) the organization defines the information system components for which the content of audit records generated is centrally managed; and, (ii) the organization centrally manages the content of audit records generated by organization-defined High [Test: AU-3(2).1 - Centralized Management Of Planned Audit Record Content] Not Entered
[E-# OR W-#] Spam Protection [NIST 800-53 w/ DHS 4300A SI-8] [Test: SI-8.1 - Spam Protection] Not Entered Failure of the information system to implement spam protection by following the requirements listed below could lead to information disclosure: (i) the organization mploys spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and (ii) the organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures. High [Test: SI-8.1 - Spam Protection] Not Entered [E-# OR W-#] Software and Information Integrity [NIST 800-53 w/ DHS 4300A SI-7 (2)] [Test: SI-7(2).1 - Automated Notifications Of Integrity Violations] Not Entered Failure to ensure that the organization employs automated tools that provide notification to personnel or roles upon discovering discrepancies during integrity verification could result in the untimely remediation of discrepancies on/of information system functionality, which could eventually lead to the loss of organizational assets or to the High [Test: SI-7(2).1 - Automated Notifications Of Integrity Violations] Not Entered
of the system to potential damage from physical/environmental hazards and to unauthorized access. [E-# OR W-#] Remote Access [NIST 800-53 w/ DHS 4300A AC-17 (2)] [Test: AC-17(2).1 - Protection Of Confidentiality / Integrity Using Encryption] Not Entered Failure of the information system to employ cryptography to protect the confidentiality and integrity of remote access sessions result in the disclosure of critical or sensitive information. High [Test: AC-17(2).1 - Protection Of Confidentiality / Integrity Using Encryption] Not Entered [E-# OR W-#] Emergency Power [NIST 800-53 w/ DHS 4300A PE-11 (1)] [Test: PE-11(1).1 - Long-Term Alternate Power Supply - Minimal Operational Capability] Not Entered Failure of the organization to provide a long-term alternate power supply for the information system that is capable of maintaining minimally required operational capability in the event of an extended loss of the primary power source could result in the unavailability of critical mission/business information on systems. High [Test: PE-11(1).1 - Long-Term Alternate Power Supply - Minimal Operational Capability] Not Entered [E-# OR W-#] Audit Reduction and Report Generation [NIST 800-53 w/ DHS 4300A AU-7] [Test: AU-7.1 - Audit Reduction and Report Generation] Not Entered Failure of the information system to provide reduction and report generation tools that support after-the-fact investigations of security incidents without altering original audit records could result in unwanted amount of High [Test: AU-7.1 - Audit Reduction and Report Generation] Not Entered
information, which could lead to the inability to track in a timely manner any attack on the system or data. [E-# OR W-#] Marking [NIST 800-53 w/ DHS 4300A MP-3] [Test: MP-3.1 - Marking] Not Entered Failure to meet the media marking requirements listed below could lead to the compromise of the system or of the data in the system: (i) the organization marks removable media and information system output in accordance with organizational policies and procedures, indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and, (ii) the organization defines removable media types output exempt from marking as long as the exempted items remain within controlled areas designated. High [Test: MP-3.1 - Media Marking] Not Entered [E-# OR W-#] Remote Access [NIST 800-53 w/ DHS 4300A AC-17 (4)] [Test: AC-17(4).1 - Privileged Commands / Access] Not Entered Failure to meet the remote access requirements listed below could result in the of critical tasks by users requiring remote access to resources in the information system: High [Test: AC-17(4).1 - Privileged Commands / Access] Not Entered
(i) the organization authorizes the execution of privileged commands and access to security-relevant information via remote access only for compelling operational needs; and (ii) the organization documents the rationale for such access in the security plan for the information system. [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS CM-2 (3)] [Test: CM-2(3).1 - Retention Of Previous Configurations] Not Entered Failure to ensure that the organization retains older versions of baseline configurations as deemed necessary to support rollback could result in a weak security stance of the organization due to the untimely detection of misconfigured systems or of systems that need configuration updates. High [Test: CM-2(3).1 - Retention Of Previous Configurations] Not Entered [E-# OR W-#] Information System Recovery and Reconstitution [NIST 800-53 w/ DHS 4300A CP-10 (4)] [Test: CP-10(4).1 - Restore Within Time Period] Not Entered Failure to meet the information system recovery and reconstitution requirements listed below could result in the loss of system integrity or stability, which could lead to the disruption of critical mission/business functions, operations, and processes: High [Test: CP-10(4).1 - Restore Within Time Period] Not Entered
(i) the organization defines the time-periods within which information system components must be re-imaged from configuration-controlled and integrity-protected disk images representing a secure, operational state for the components; and (ii) the organization provides the capability to re-image information system components, within organization-defined from and disk images representing a secure, operational state for the components. [E-# OR W-#] Use of External Information Systems [NIST w/ DHS 4300A AC-20 (2)] [Test: AC-20(2).1 - Portable Storage Devices] Not Entered Failure to ensure that the organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems could leave essential data exposed to unauthorized access and viewing by individuals not connected to the organization. High [Test: AC-20(2).1 - Portable Storage Devices] Not Entered [E-# OR W-#] Vulnerability Scanning [NIST [Test: RA-5(4).1 - Failure to ensure that the organization attempts to discern what information High [Test: RA-5(4).1 - Discoverable Information]
800-53 w/ DHS 4300A RA-5 (4)] Discoverable Information] Not Entered the information system is discoverable by adversaries could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization. Not Entered [E-# OR W-#] Services [NIST 800-53 w/ DHS 4300A CP-8 (3)] [Test: CP-8(3).1 - Separation Of Primary / Alternate Providers] Not Entered Failure to meet the telecommunications services requirements listed below could leave the system vulnerable to environmental risks and other non-operational factors that may cause direct or indirect damage to the working system: (i) the organization identifies the primary provider's telecommunications service hazards; and (ii) the alternate telecommunications service providers are separated from the primary telecommunications service providers so as not to be susceptible to the same hazards. High [Test: CP-8(3).1 - Separation Of Primary / Alternate Providers] Not Entered [E-# OR W-#] Maintenance Tools [NIST 800-53 w/ [Test: MA-3(1).1 - Failure of the organization to inspect all maintenance tools (e.g., diagnostic and test High [Test: MA-3(1).1 - Inspect Tools]
temporary and emergency accounts after time period for each type of account; and, (ii) the organization defines a time period for each type of account after which the information system terminates temporary and emergency accounts. [E-# OR W-#] Incident Reporting [NIST 800-53 w/ DHS 4300A IR-6 (1)] [Test: IR-6(1).1 - Automated Reporting] Not Entered Failure of the organization to employ automated mechanisms to assist in the reporting of security incidents lead to the organization failing to attend to an incident in a timely manner and eventually losing critical mission/business assets. High [Test: IR-6(1).1 - Automated Reporting] Not Entered [E-# OR W-#] Least Privilege [NIST 800-53 w/ DHS 4300A AC-6 (9)] [Test: AC-6(9).1 - Auditing Use Of Privileged Functions] Not Entered Failure to audit privilege functions could leave the system vulnerable to several risks including access by untrained or unauthorized personnel, improper configuration, or faulty monitoring. High [Test: AC-6(9).1 - Auditing Use Of Privileged Functions] Not Entered [E-# OR W-#] Emergency Power [NIST 800-53 w/ DHS 4300A PE-11] [Test: PE-11.1 - Emergency Not Entered Failure of the organization to provide a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system or transition of the information system to long-term alternate High [Test: PE-11.1 - Emergency Power] Not Entered
Not Entered systems due to the inability to track which integral components need to be installed. [E-# OR W-#] Fire Protection [NIST 800-53 w/ DHS 4300A PE-13 (2)] [Test: PE-13(2).1 - Suppression Devices / Systems] Not Entered Failure of the organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to organization-defined personnel and organization-defined emergency responders could lead to accidents or personnel/employee injury due to the lack of fire suppression devices/systems or due to untimely notification. High [Test: PE-13(2).1 - Suppression Devices / Systems] Not Entered [E-# OR W-#] Contingency Plan [NIST 800-53 w/ DHS 4300A CP-2 (1)] [Test: CP-2(1).1 - Coordinate With Related Plans] Not Entered Failure of the organization to coordinate the contingency plan with other related plans (e.g., Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Business Recovery Plan, Incident Response Plan, Emergency Action Plan) could lead to the unavailability of systems that is critical to the overall business processes. High [Test: CP-2(1).1 - Coordinate With Related Not Entered [E-# OR W-#] Remote Access [NIST 800-53 w/ [Test: AC-17(1).1 - Failure of the information system to employ automated mechanisms to facilitate the High [Test: AC-17(1).1 - Automated Monitoring / Control]
contract] or received a message) could lead to compromise of the system or of the data in the system. [E-# OR W-#] Developer Security Testing and Evaluation [NIST 800-53 w/ DHS 4300A SA-11] [Test: SA-11.1 - Developer Security Testing and Evaluation] Not Entered Failure of the organization to require the developer of the information system, system component, or information system service to perform tasks indicated below could leave the system more exposed to vulnerabilities: (i) Create and implement a security assessment plan that provides for security testing and evaluation: at the depth of functional properties, security related externally visible interfaces, design, low-level design, or implementation representation (source code/hardware schematics; and at the rigor of showing, demonstrating, or High [Test: SA-11.1 - Developer Security Testing and Evaluation] Not Entered
is a need for configuration changes to be implemented. [E-# OR W-#] Media Transport [NIST 800-53 w/ DHS 4300A MP-5 (4)] [Test: MP-5(4).1 - Cryptographic Protection] Not Entered Failure to ensure that the organization employs cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas could lead to sensitive information or data to be modified and used by unauthorized users. High [Test: MP-5(4).1 - Cryptographic Protection] Not Entered [E-# OR W-#] Security Impact Analysis [NIST 800-53 w/ DHS 4300A CM-4 (1)] [Test: CM-4(1).1 - Separate Test Environments] Not Entered Failure to meet the security impact analysis requirements listed below could lead to the compromise of the system or of the data in the system: (i) the organization analyzes new software in a separate test environment before installation in an operational environment; and (ii) the organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. High [Test: CM-4(1).1 - Separate Test Environments] Not Entered [E-# OR W-#] Protection of Information [NIST Failure to meet the protection of audit information High [Test: AU-9(4).1 - Access By Subset Of
loss of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes. [E-# OR W-#] System Security Plan [NIST 800-53 w/ DHS 4300A (3)] [Test: PL-2(3).1 - Plan / Coordinate With Other Entities] Not Entered Failure to ensure that the organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities could result in the loss of information. High [Test: PL-2(3).1 - Plan / Coordinate With Entities] Not Entered [E-# OR W-#] Software and Information Integrity [NIST 800-53 w/ DHS 4300A SI-7 (7)] [Test: SI-7(7).1 - Integration Of Detection And Response] Not Entered Failure to ensure that the organization incorporates the detection of unauthorized organization-defined changes to the information system into the organizational incident response capability could permit an attacker or a malicious user to gain unauthorized access to the system or data and could risk the loss of critical mission/business assets. High [Test: SI-7(7).1 - Integration Of Detection And Response] Not Entered [E-# OR W-#] Least Privilege [NIST 800-53 w/ Failure to meet the privilege requirements listed High [Test: AC-6(1).1 - Authorize Access To
causing unpredictable equipment performance, which could lead to the system losing its stability and its integrity. [E-# OR W-#] Contingency Plan Testing and Exercises [NIST 800-53 w/ DHS 4300A CP-4 (2)] [Test: CP-4(2).1 - Alternate Processing Site] Not Entered Failure of the organization to conduct contingency plan testing at the alternate processing site to familiarize contingency personnel with the facility and its resources and to evaluate the site’s capabilities to support contingency operations result in the lack of knowledge of the key personnel regarding the facility and its resources, which could leave the site being incapable of supporting the organization's contingency operations. High [Test: CP-4(2).1 - Alternate Processing Site] Not Entered [E-# OR W-#] Services [NIST 800-53 w/ DHS 4300A CP-8 (4)] [Test: CP-8(4).1 - Provider Contingency Plan] Not Entered Failure of the organization to require primary and alternate telecommunications service providers to have contingency plans deemed adequate by the organization could lead to the disruption of critical mission/business functions, operations, and processes due to the ineffective contingency plans for either the primary or the alternate telecommunications service. High [Test: CP-8(4).1 - Provider Contingency Plan] Not Entered
Not Entered and exploits identified with and inherent in malicious codes enabling any determined attacker or user to gain unauthorized access to the system, which could eventually lead to the loss of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes. [E-# OR W-#] Session Termination [NIST 800-53 w/ DHS 4300A AC-12] [Test: AC-12.1 - Session Termination] Not Entered Failure to terminate a user session when conditions or trigger events have been detected could enable an attacker to try and break into the system and gain access to classified information. High [Test: AC-12.1 - Session Termination] Not Entered [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 (7)] [Test: SC-7(7).1 - Prevent Split Tunneling For Remote Devices] Not Entered Failure to ensure that the information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some connection to resources in external networks could leave the system vulnerable as targets for hackers. High [Test: SC-7(7).1 - Prevent Split Tunneling For Remote Devices] Not Entered [E-# OR W-#] Session Authenticity [NIST [Test: SC-23.1 - Failure to ensure that the information system protects the authenticity of communications High [Test: SC-23.1 - Session Authenticity]
800-53 w/ DHS SC-23] Session Authenticity] Not Entered sessions could risk the disclosure of sensitive information or the disruption of critical mission/business functions, services, and operations/processes. Not Entered [E-# OR W-#] Transmission Integrity [NIST 800-53 w/ DHS 4300A SC-8 (1)] [Test: SC-8(1).1 - Cryptographic Or Alternate Physical Protection] Not Entered Failure to ensure that the information system implements cryptographic mechanisms to prevent unauthorized disclosure of information or detect changes to information during transmission unless otherwise protected by organization-defined alternative physical safeguards could allow an attacker or a malicious user to employ various tactics/strategy to intercept the transmission and gain unauthorized access to critical and sensitive information/data. High [Test: SC-8(1).1 - Cryptographic Or Alternate Physical Protection] Not Entered [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 (5)] [Test: SC-7(5).1 - Deny By Default / Allow By Exception] Not Entered Failure to ensure that the information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception) could result to undetected unauthorized access. High [Test: SC-7(5).1 - Deny By Default / Allow By Exception] Not Entered
[E-# OR W-#] Audit Generation [NIST 800-53 w/ DHS 4300A AU-12 (3)] [Test: AU-12(3).1 - Changes By Authorized Individuals] Not Entered Failure to meet the audit generation requirements listed below could result in the loss of the generated audit data, which could render an audit or forensic investigation efforts useless: (i) the organization has the ability to extend or limit auditing as necessary to meet organizational requirements; (ii) the organization establishes time thresholds in which audit actions are changed; and, (iii) information system provides the capability for authorized personnel to change organization-defined time thresholds. High [Test: AU-12(3).1 - Changes By Authorized Individuals] Not Entered [E-# OR W-#] Memory Protection [NIST 800-53 w/ DHS 4300A SI-16] [Test: SI-16.1 - Memory Protection] Not Entered Failure to ensure that the information system implements organization-defined security safeguards to protect its memory from unauthorized code execution could permit an attacker or a malicious user to gain unauthorized access to the system or data and could risk the loss of critical mission/business assets. High [Test: SI-16.1 - Memory Protection] Not Entered [E-# OR W-#] Access Control for Transmission Failure of the organization to control physical access to High [Test: PE-4.1 - Access Control for
DHS 4300A AT-2 (2)] [Test: AT-2(2).1 - Insider Threat] Not Entered Not Entered Not Entered awareness training on recognizing and reporting potential indicators of insider threat could result in the organization's personnel's inability to communicate employee and management concerns regarding insider threats. Not Entered Not Entered Not Entered [E-# OR W-#] Account Management [NIST 800-53 w/ DHS 4300A AC-2 (3)] [Test: AC-2(3).1 - Disable Inactive Accounts] Not Entered Failure to meet the account management requirements indicated below could result in an inaccurate audit report and could enable an intruder to utilize the inactive accounts as access points to the system: (i) the organization defines in a time period after which the information system disables inactive accounts; and (ii) the information system automatically disables inactive accounts after time period. High [Test: AC-2(3).1 - Disable Inactive Accounts] Not Entered [E-# OR W-#] Developer Configuration Management [NIST 800-53 w/ DHS 4300A SA-10] [Test: SA-10.1 - Developer Configuration Management] Not Entered Failure to meet the developer configuration management requirements listed below could lead to instability of the system or possibly to the compromise of the system: (i) perform configuration High [Test: SA-10.1 - Developer Configuration Management] Not Entered
Not Entered termination of an individual could risk data being compromised by such individuals. [E-# OR W-#] Alternate Processing Site [NIST 800-53 w/ DHS 4300A CP-7 (4)] [Test: CP-7(4).1 - Preparation For Use] Not Entered Failure to ensure that the alternate processing site is configured to support the minimum required information system operational capability and is ready to use as the operational site could lead to the inability to restore business operations/processes in a timely fashion. High [Test: CP-7(4).1 - Preparation For Use] Not Entered [E-# OR W-#] Boundary Protection [NIST 800-53 w/ DHS 4300A SC-7 (8)] [Test: SC-7(8).1 - Route Traffic To Authenticated Proxy Servers] Not Entered Failure to ensure that the information system routes organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces could permit an attacker or a malicious user to gain unauthorized access to the system or data and could risk the loss of critical mission/business assets. High [Test: SC-7(8).1 - Route Traffic To Authenticated Proxy Servers] Not Entered [E-# OR W-#] Incident Handling [NIST 800-53 w/ DHS 4300A IR-4 (4)] [Test: IR-4(4).1 - Information Correlation] Failure to ensure that the organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident High [Test: IR-4(4).1 - Information Correlation] Not Entered
Not Entered awareness and response could prevent the immediate restoration of the system into its stable working state should an attack occur. [E-# OR W-#] Least Privilege [NIST 800-53 w/ DHS 4300A AC-6 (10)] [Test: AC-6(10).1 - Prohibit From Executing Privileged Functions] Not Entered Failure to prevent users from executing privileged functions could leave the system vulnerable to several risks including access by untrained or unauthorized personnel, improper configuration, or faulty monitoring. High [Test: AC-6(10).1 - Prohibit Users From Executing Privileged Functions] Not Entered [E-# OR W-#] Vulnerability Scanning [NIST 800-53 w/ DHS 4300A RA-5 (2)] [Test: RA-5(2).1 - Update By Frequency / Prior To New Scan / When Identified] Not Entered Failure to meet the vulnerability scanning requirement listed below could put the organization in weaker security posture that could result in unauthorized disclosure of information, greater compromise of the system, or to other more severe security threats against the organization: (i) the organization defines the frequency of updates for information system vulnerabilities scanned; and (ii) the organization updates the list of information system vulnerabilities scanned in High [Test: RA-5(2).1 - Update By Frequency / To New Scan / When Identified] Not Entered
accordance with the organization-defined frequency or when new vulnerabilities are identified and reported. [E-# OR W-#] Protection of Information [NIST 800-53 w/ DHS 4300A AU-9 (3)] [Test: AU-9(3).1 - Cryptographic Protection] Not Entered Failure to ensure that the information system uses cryptographic mechanisms to protect the integrity of audit information and audit tools could result in the loss of integrity of the audit information or of the audit tools, which could invalidate any result of forensic investigation. High [Test: AU-9(3).1 - Cryptographic Protection] Not Entered [E-# OR W-#] Penetration Testing [NIST 800-53 w/ DHS 4300A CA-8] [Test: CA-8.1 - Penetration Testing] Not Entered Failure to meet the penetration testing requirements listed below could lead to compromise of the system or of the data in the system: (i) the organization conducts penetration testing in an organizational-defined frequency; (ii) the organization conducts penetration testing on information systems or individual system components to identify vulnerabilities that could be exploited by adversaries; (iii) the organization follows High [Test: CA-8.1 - Penetration Testing] Not Entered
standard penetration testing methods: pretest analysis on full knowledge of the target system; pretest identification of potential vulnerabilities based on pretest analysis; and, testing designed to determine exploitability of identified vulnerabilities. (iv) the organization agrees the rules of engagement before commencing penetration testing scenarios; [E-# OR W-#] Information System Recovery and Reconstitution [NIST 800-53 w/ DHS 4300A CP-10 (2)] [Test: CP-10(2).1 - Transaction Recovery] Not Entered Failure to ensure that the information system implements transaction recovery for systems that are could compromise data integrity and availability, should a system go down unexpectedly. High [Test: CP-10(2).1 - Transaction Recovery] Not Entered [E-# OR W-#] Monitoring Physical Access [NIST w/ DHS (4)] [Test: PE-6(4).1 - Monitoring Physical Access To Failure to ensure that the organization monitors physical access to the information system in addition to the physical access monitoring of High [Test: PE-6(4).1 - Monitoring Physical Access To Information Systems]
a traffic flow policy for each managed interface; (iii) the organization protects the confidentiality and integrity of the information being transmitted across each interface; (iv) the organization documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and (v) the organization reviews exceptions to the traffic flow policy [Assignment: organization-defined frequency] and removes exceptions that are no longer supported by an explicit mission/business need. [E-# OR W-#] Information System Component Inventory [NIST 800-53 w/ DHS 4300A CM-8 (5)] [Test: CM-8(5).1 - No Duplicate Accounting Of Components] Not Entered Failure to ensure that the organization verifies that all components within the authorization boundary of the information system are either inventoried as a part of the system or recognized by another system as a component within that system could eventually lead to the loss of High [Test: CM-8(5).1 - No Duplicate Accounting Of Components] Not Entered
[E-# OR W-#] Fire Protection [NIST 800-53 w/ DHS PE-13 (3)] [Test: PE-13(3).1 - Automatic Fire Suppression] Not Entered Failure of the organization to employ an automatic fire suppression capability in facilities that are not staffed on a continuous basis could risk damage to the facilities, systems, and data/information, which could lead to the disruption of critical mission/business operations. High [Test: PE-13(3).1 - Automatic Fire Suppression] Not Entered [E-# OR W-#] Access Records [NIST 800-53 w/ DHS 4300A PE-8 (1)] [Test: PE-8(1).1 - Automated Records Maintenance / Review] Not Entered Failure of the organization to employ automated mechanisms to facilitate the maintenance and review of access records could result in the untimely detection of unauthorized access, which could lead to the complete compromise of the system or the information in the system. High [Test: PE-8(1).1 - Automated Records Maintenance / Review] Not Entered [E-# OR W-#] Timely Maintenance [NIST 800-53 w/ DHS MA-6] [Test: MA-6.1 - Timely Maintenance] Not Entered Failure to meet the timely maintenance requirements listed below could lead to the compromise of the system or of the data in the system: (i) the organization defines security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts; High [Test: MA-6.1 - Timely Maintenance] Not Entered
(ii) the organization defines the time period within which support and/or spare parts must be obtained after a failure; and (iii) the organization obtains maintenance support and/or spare parts for the organization-defined list of security-critical information system components and/or key information technology components within the organization-defined time period of failure. [E-# OR W-#] Contingency Plan [NIST 800-53 w/ DHS 4300A CP-2 (5)] [Test: CP-2(5).1 - Continue Essential Missions / Business Functions] Not Entered Failure to meet the contingency plan requirements listed below could weaken the overall security posture of the system: (i) the organization plans for the continuance of essential missions and business functions with little or no loss of operational continuity; and (ii) the organization sustains operational continuity until full information system restoration at primary processing and/or storage sites. High [Test: CP-2(5).1 - Continue Essential Missions / Business Functions] Not Entered [E-# OR W-#] Configuration Change Control [NIST 800-53 w/ [Test: - Timely Failure of the ISSO to ensure timely responses to Infrastructure Change Control Board (ICCB) change request High [Test: - Timely Response to ICCB]
DHS 4300A CM-3 (DHS-2.1.8.g)] Response to ICCB] Not Entered packages could leave the system vulnerable to unexpected instability in operation. Not Entered [E-# OR W-#] Least Functionality [NIST 800-53 w/ DHS 4300A CM-7 (5)] [Test: CM-7(5).1 - Authorized Software / Whitelisting] Not Entered Failure to meet the white listing requirements listed below could leave the system vulnerable to attacks and denial-of-service conditions: (i) the organization identifies software programs authorized to execute on the information system; (ii) the organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and, (iii) the organization reviews and updates the list of authorized software programs on an organization-defined frequency. High [Test: CM-7(5).1 - Authorized Software / Whitelisting] Not Entered [E-# OR W-#] Baseline Configuration [NIST 800-53 w/ DHS 4300A CM-2 (1)] [Test: CM-2(1).1 - Reviews And Updates] Not Entered Failure of the organization to update the baseline configuration of the information system as an integral part of information system component installations could result in a weak security stance of the organization due to the untimely detection of High [Test: CM-2(1).1 - Reviews And Updates] Not Entered
audits of information system changes in accordance with the organization-defined frequency and when indications so warrant to determine whether unauthorized changes have occurred. [E-# OR W-#] Contingency Training [NIST 800-53 w/ DHS 4300A CP-3 (1)] [Test: CP-3(1).1 - Simulated Events] Not Entered Failure of the contingency training material to address the procedures and activities necessary to fulfill identified organizational contingency and responsibilities could lead to the compromise of the system or of the data in the system: (i) the organization incorporates simulated events into contingency training; and (ii) the incorporation of simulated events into contingency training facilitates effective response by personnel in crisis situations. High [Test: CP-3(1).1 - Simulated Events] Not Entered [E-# OR W-#] Wireless Access [NIST 800-53 w/ DHS 4300A AC-18 (4)] [Test: AC-18(4).1 - Restrict Configurations By Users] Not Entered Failure to meet the user configuration restriction requirements indicated below could result in a number of unmanaged and unauthorized wireless access to the information system: High [Test: AC-18(4).1 - Restrict Configurations By Users] Not Entered
800-53 w/ DHS 4300A MA-4 (2)] [Test: MA-4(2).1 - Document Nonlocal Maintenance] Not Entered of remote maintenance and diagnostic links in the security plan for the information system could lead to the system losing its integrity and stability or to the critical information/data being disclosed. Maintenance] Not Entered [E-# OR W-#] Access Restrictions for Change [NIST 800-53 w/ DHS 4300A CM-5] [Test: CM-5.1 - Access Restrictions for Change] Not Entered Failure to ensure that the organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system could lead to the compromise of the system or of the data in the system: High [Test: CM-5.1 - Access Restrictions for Change] Not Entered [E-# OR W-#] Identification and Authentication (Organizational Users) [NIST w/ DHS 4300A IA-2 (11)] [Test: IA-2(11).1 - Remote Access - Separate Device] Not Entered Failure to ensure that the information system implements multifactor authentication for remote access to privileged and non-privileged accounts could result in providing any account access to critical or sensitive information. High [Test: IA-2(11).1 - Remote Access - Separate Device] Not Entered [E-# OR W-#] Content of Audit Records [NIST w/ DHS 4300A AU-3 (1)] [Test: AU-3(1).1 - Additional Audit Information] Not Entered Failure of the information system to provide the capability to include additional, more detailed information in the audit records for audit events identified by type, location, or subject could result in incomplete data critical to the success of a forensic High [Test: AU-3(1).1 - Additional Audit Information] Not Entered