Exhibit_A_-Security_Requirements_Traceability_Matrix.xlsx

System Tests

Test (Comprehensive): Automated mechanisms implementing authenticator management functions. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

348 AC-2 (1) Not Executed Main Location AC-2(1).1 - Automated System Account Management Failure of the organization to employ automated mechanisms to support information system account management functions could promote a non-standard way of handling information system account management functions resulting in inaccurate information critical to the operation of the system. Examine (Comprehensive): Procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing account management functions. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

457 AC-2 (2) Not Executed Main Location AC-2(2).1 - Removal Of Temporary / Emergency Accounts Failure to meet the account management requirements indicated below could result in inaccurate system account audit reports and in rogue temporary and emergency accounts in the system, which could enable would-be attackers to utilize these rogue accounts as access points to the system and consequently launch attack vectors against the entry computer and other neighboring computers:

(i) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account; and,

(ii) the organization defines a time period for each type of account after which the information system terminates temporary and emergency accounts. Examine (Comprehensive): Security plan; information system design documentation; information system configuration settings and associated documentation; information system-generated list of active accounts; information system audit records; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing account management functions. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

676 AC-2 (3) Not Executed Main Location AC-2(3).1 - Disable Inactive Accounts Failure to meet the account management requirements indicated below could result in an inaccurate audit report and could enable an intruder to utilize the inactive accounts as access points to the system:

(i) the organization defines in a time period after which the information system disables inactive accounts; and

(ii) the information system automatically disables inactive accounts after organization-defined time period. Examine (Comprehensive): Procedures addressing account management; security plan; information system design documentation; information system configuration settings and associated documentation; information system-generated list of last login dates; information system- generated list of active accounts; information system audit records; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing account management functions. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

716 AC-2 (4) Not Executed Main Location AC-2(4).1 - Automated Audit Actions Failure to meet the account management requirements listed below could promote a non-standard way of handling information system account management functions resulting in inaccurate information critical to the operation of the system:

(i) the information system automatically audits:

- account creation;

- modification;

- disabling; and

- termination actions; and

(ii) the information system notifies, as required, appropriate individuals. Examine (Comprehensive): Procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing account management functions. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

423 AC-2 (5) Not Executed Main Location AC-2(5).1 - Inactivity Logout Failure to require users to log out in accordance with the organization-defined time-period of inactivity and/or description of when to log out could leave the system vulnerable to improper utilization of resources due to unmonitored usage times of systems and non-compliance to access restrictions that are critical to the overall durability of organizational assets. Examine (Comprehensive): Procedures addressing account management; security plan; information system design documentation; information system configuration settings and associated documentation; security violation reports; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with account management responsibilities. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

477 AC-2 (11) Not Executed Main Location AC-2(11).1 - Usage Conditions Failure to describe the specific conditions or circumstances under which information system accounts can be used could leave the system vulnerable to improper utilization of resources due to unmonitored activity of access. Examine (Comprehensive): Procedures addressing account management; information system design documentation; information system configuration settings and associated documentation; information system-generated list of privileged user accounts and associated role; information system audit records; audit tracking and monitoring reports; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with account management responsibilities. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

640 AC-2 Not Executed Main Location AC-2.1 - Account Management Failure to meet the account management requirements listed below could enable an intruder to gain access to a system account through social engineering or other methods and elevate the account's rights to a higher privileged account to try and penetrate the system and cause intentional or unintentional damage:

(i) the organization identifies information system accounts to support organizational missions/business functions;

(ii) the organization assigns account managers for information system accounts;

(iii) the organization establishes conditions for group and role membership;

(iv) the organization specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

(v) the organization requires approvals by organization-defined personnel or roles for requests to create information system accounts;

(vi) the organization creates, enables, modifies, disables, and removes information system accounts;

(vii) the organization authorizes, and monitors the use of, information system accounts;

(viii) the organization notifies account managers:

- When accounts are no longer required;

- When users are terminated or transferred; and,

- When individual information system usage or need-to-know changes;

(ix) the organization authorizes access to the information system based on:

- A valid access authorization;

- Intended system usage; and,

- Other attributes as required by the organization or associated missions/business functions;

(x) the organization reviews accounts for compliance with account management requirements in accordance with organization-defined frequency; and,

(xi) the organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group. Examine (Comprehensive): Access control policy; procedures addressing account management; security plan; list of active system accounts along with the name of the individual associated with each account; list of guest/anonymous and temporary accounts along with the name of the individual associated with each account and the date the account expires; lists of recently transferred, separated, or terminated employees; list of recently disabled information system accounts along with the name of the individual associated with each account; system-generated records with user IDs and last login date; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with account management responsibilities. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

490 AC-3 (DHS-5.1.1.d) Not Executed Main Location AC-3(DHS-5.1.1.d) - Use of group passwords Failure to meet the requirements for using group IDs listed below could expose the information system to unauthorized access and lead to compromise of the system's integrity and confidentiality:

- group passwords are limited to situations dictated by operational necessity or critical for mission accomplishment; and,

- group User ID and password is approved by the appropriate Authorizing Official (AO). Examine (Comprehensive): Identification and authentication policy; procedures addressing identifier management; procedures addressing account management; security plan; information system design documentation; information system configuration settings and associated documentation; list of information system accounts; list of identifiers generated from physical access control devices; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with identifier management responsibilities. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

414 AC-3 Not Executed Main Location AC-3.1 - Access Enforcement Failure to ensure that the information system enforces approved authorizations for logical access to the system in accordance with applicable policy could allow the system to become vulnerable to unauthorized access via improper account use. Examine (Comprehensive): Access control policy; procedures addressing access enforcement; information system configuration settings and associated documentation; list of approved authorizations (user privileges); information system audit records; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing access enforcement policy. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

730 AC-4 Not Executed Main Location AC-4.1 - Information Flow Enforcement Failure of the information system to use protected processing domains could result in an unsuitable, inaccurate or unreliable information flow enforcement control implementation. Examine (Comprehensive): Access control policy; procedures addressing information flow enforcement; information system design documentation; information system configuration settings and associated documentation; information system baseline configuration; list of information flow authorizations; information system audit records; other relevant documents or records.

Test (Comprehensive): Automated mechanisms implementing information flow enforcement policy. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

377 AC-5 Not Executed Main Location AC-5.1 - Separation of Duties Failure to meet the requirements for separation of duties indicated below could result in the wrong assignment of rights, overlapping privileges, and overall account mismanagement:

(i) the organization separates duties of individuals as necessary, to prevent malevolent activity without collusion;

(ii) the organization documents separation of duties; and

(iii) the organization implements separation of duties through assigned information system access authorizations. Examine (Comprehensive): Access control policy; procedures addressing divisions of responsibility and separation of duties; information system configuration settings and associated documentation; list of divisions of responsibility and separation of duties; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties.

Test (Comprehensive): Automated mechanisms implementing separation of duties policy. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

For activities:

- Determine if the activity is being performed.

- Determine if the activity, as performed, has no obvious inconsistencies with the functional requirements in the security control and no obvious execution errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the activity is being performed correctly and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the conduct or execution of the activity.

- Determine if the organization performs the activity consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the activity by taking specific actions to correct identified deficiencies.

622 AC-6 (1) Not Executed Main Location AC-6(1).1 - Authorize Access To Security Functions Failure to meet the least privilege requirements listed below could leave the system vulnerable to unauthorized access:

(i) the organization defines the security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized; and

(ii) the organization explicitly authorizes access to the organization-defined security functions and security-relevant information. Examine (Comprehensive): Access control policy; procedures addressing least privilege; list of security functions and security-relevant information for which access must be explicitly authorized; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

624 AC-6 (2) Not Executed Main Location AC-6(2).1 - Non-Privileged Access For Nonsecurity Functions Failure to meet the least privilege requirements listed below could leave the system vulnerable to unauthorized access:

(i) the organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access;

(ii) the organization requires that users of information system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other system functions; and,

(iii) the organization, if deemed feasible, audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions. Examine (Comprehensive): Access control policy; procedures addressing least privilege; list of system- generated security functions or security-relevant information assigned to information system accounts or roles; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

386 AC-6 (3) Not Executed Main Location AC-6(3).1 - Network Access To Privileged Commands Failure to meet the least privilege requirements listed below could leave the system vulnerable to impersonation attacks leading to compromise of system related controls or extraction of essential data:

(i) the organization defines the privileged commands to which network access is to be authorized only for compelling operational needs;

(ii) the organization authorizes network access to organization-defined privileged commands only for compelling operational needs; and

(iii) the organization documents the rationale for authorized network access to organization-defined privileged commands in the security plan for the information system. Examine (Comprehensive): Access control policy; procedures addressing least privilege; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

330 AC-6 (5) Not Executed Main Location AC-6(5).1 - Privileged Accounts Failure to ensure that the organization limits authorization to super user accounts on the information system to designated system administration personnel could compromise the overall stability of the system should unqualified personnel be allowed access to essential system controls and configuration tools. Examine (Comprehensive): Access control policy; procedures addressing least privilege; list of system- generated super user accounts; list of system administration personnel; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

369 AC-6 (9) Not Executed Main Location AC-6(9).1 - Auditing Use Of Privileged Functions Failure to audit privilege functions could leave the system vulnerable to several risks including access by untrained or unauthorized personnel, improper configuration, or faulty monitoring. Examine (Comprehensive): Access control policy; procedures addressing least privilege; list of system- generated privileged accounts; list of non-organizational users; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the mechanism is implemented and operational.

- Determine if the mechanism, as implemented, has no obvious inconsistencies with the functional requirements in the security control and no obvious implementation errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the mechanism is implemented correctly, operating as intended, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the implementation or operation of the mechanism.

- Determine if the organization implements the mechanism consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the mechanism by taking specific actions to correct identified deficiencies.

829 AC-6 (10) Not Executed Main Location AC-6(10).1 - Prohibit Non-Privileged Users From Executing Privileged Functions Failure to prevent non-privileged users from executing privileged functions could leave the system vulnerable to several risks including access by untrained or unauthorized personnel, improper configuration, or faulty monitoring. Examine (Comprehensive): Access control policy; procedures addressing least privilege; list of system- generated privileged accounts; list of non-organizational users; information system configuration settings and associated documentation; information system audit records; other relevant documents or records.

Interview (Comprehensive): Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks. For specifications:

- Determine if the specification exists.

- Determine if the specification, as written, has no obvious inconsistencies with the functional requirements in the security control and no obvious internal errors.

- Determine if the organization provides an assignment of responsibilities, specific actions, and appropriate documentation to support increased grounds for confidence that the specification is complete, internally consistent, correct, and meets its required function or purpose.

- Determine if the organization identifies and documents anomalies or problems with the application or use of the specification.

- Determine if the organization applies the specification consistently across the information system.

- Determine if the organization supports improvement in the effectiveness of the specification by taking specific actions to correct identified deficiencies.

For mechanisms:

- Determine if the…