Exhibit_G_-Security_Assessment_Report.doc

[Document classification not provided]

DHS Sample System [project ID not provided] Security Assessment Report

(SAR)

Prepared for Department of Homeland Security Headquarters (DHS HQ) [Component address not provided] [project version not provided] 17 March 2015

EXECUTIVE SUMMARY

This security assessment performed on the DHS Sample System follows guidance from the National Institute of Standards and Technology (NIST) Special Publication 800-30, Guide for Conducting Risk Assessments, and incorporates policy from the Department of Homeland Security (DHS) Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook (4300A SSH).

The security assessment was performed by Department of Homeland Security Headquarters (DHS HQ).

Table of Contents

1.0 Introduction

1.1 Purpose

1.2 Scope

1.3 System Data

1.4 Team Composition

1.5 Assumptions and Constraints

1.6 Risk Rating Scale

2.0 Security Assessment Results

3.0 Conclusion

3.1 Statement of Residual Risk

3.2 Level of Acceptable Risk

3.3 Security Control Assessor Recommendation to AO

1.0 Introduction

This Security Assessment Report was developed from the DHS Sample System activities associated with the security authorization process using guidance contained in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Revision 1, Guidelines for Applying the Risk Management Framework to Federal Information Systems.

1.1 Purpose

The purpose of this report is to identify to the Authorizing Official (AO) and the System Owner (SO) the results of a Security Assessment performed on the system. The Security Assessment consists of the system Risk Assessment, Security Assessment Plan, and Contingency Plan Test.

1.2 Scope

DHS Sample System is hosted:

Table 1-1: System Resident Information

1.3 System Data

Table 1-2: FIPS 199 Categorization Summary

1.4 Team Composition

The following individuals participated in this security assessment {Add, remove, edit personnel as needed}:

Table 1-3: Security Assessment Participants

1.5 Assumptions and Constraints

The following assumptions and constraints apply to this document:

1.6 Risk Rating Scale

Table 1-4: Risk Rating Scale

Risk may be acceptable according to the system sensitivity and criticality.

Risk is probably acceptable for short term until cost effective safeguards can be implemented.

Corrective actions are needed and a plan must be developed to incorporate these actions within a reasonable period of time.

Risks are probably not acceptable according to the system sensitivity and criticality.

An existing system may continue to operate, but a corrective action plan must be put in place as soon as possible.

Probability of serious incident is likely. Risks not normally acceptable, according to the system sensitivity and criticality.

Authorization status may be rescinded or not granted.

2.0 Security Assessment Results

503 controls have been identified as being applicable to this system and 530 Tests were evaluated:

· 42 tests were implemented correctly, operating as intended, and producing the desired outcome, meeting the security requirements for the system.

· 488 Tests were failed, producing a total of 476 risks.

· 476 test result(s) present a High risk to system operation.

· 0 test result(s) present a Moderate risk to system operation.

· 0 test result(s) present a Low risk to system operation.

· 0 tests were found to be Not Applicable

The total risk level is High.

3.0 Conclusion

Table 3-1: Risks that must be Remediated within 30 days of ATO or Receive an Exception/Waiver Prior to ATO

[Test: AR-5.1 - Privacy Awareness and Training]

Not Entered Failure to meet the privacy awareness training requirements listed below could affect the readiness of personnel to respond to unexpected attacks and intrusion:

(i) the organization develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures;

(ii) the organization administers the following privacy privacy training at least annually:

· basic privacy training

· targeted, role-based privacy training for personnel having responsibility for PII or for activities that involve PII

(iii) the organization ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements at least annually.

[Test: SC-20(DHS-5.4.3.k) - DHS Secure Name / Address Resolution Service]

[Test: PM-8.1 - Critical Infrastructure Plan]

[Test: AC-22.1 - Publicly Accessible Content]

Failure to meet the publicly accessible content requirements listed below could leave essential data exposed to unauthorized access and viewing by individuals not connected to the organization:

(i) the organization designates individuals authorized to post information onto an organizational information system that is publicly accessible;

(ii) the organization trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

(iii) the organization reviews the proposed content of publicly accessible information for nonpublic information prior to posting onto the organizational information system;

(iv) the organization defines the frequency of reviews of the content on the publicly accessible organizational information system for nonpublic information;

(v) the organization reviews the content on the publicly accessible organizational information system for nonpublic information in accordance with the organization-defined frequency; and

(vi) the organization removes nonpublic information from the publicly accessible organizational information system, if discovered.

[Test: IA-2(DHS-5.1.d) - Usage of Identification or Authentication Materials]

Failure to meet the requirements for using identification or authentication materials listed below could expose information system to unauthorized access and lead to compromise of information system integrity and confidentiality:

(i) use of group passwords is limited to situations dictated by operational necessity or critical for mission accomplishment; and,

(ii) use of a group User ID and password shall be approved by the appropriate Authorizing Official (AO).

[Test: PM-16.1 - Threat Awareness Program]

[Test: AR-2.1 - Privacy Impact and Risk Assessment]

Failure to meet the privacy impact and risk assessment requirements listed below could lead eventually to the loss of personally identifiable information and other mission/business assets or to the disruption of other organization operations, functions and services:

(i) the organization documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and,

(ii) the organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

[Test: CP-1(DHS-3.5.2.d) - DHS Contingency Guidance]

[Test: CM-6(DHS-5.4.5.e) - Use of File Transfer Protocol(FTP) Services]

Failure to meet the requirements for configuration settings listed below could lead to the compromise of the system or of the data in the system:

(i) the organization does not authorize File Transfer Protocol (FTP) connections to any DHS computer;

(ii) the organization uses secure connection protocols duly approved by the Component; and

(iii) the secure connection protocols used employ any of the following authentication methods:

· two factor

· encryption

· key exchange

[Test: AC-17.1 - Remote Access]

Failure of the organization to authorize, monitor, and control remote access to the information system for all allowed methods of remote access to include both establishment of the remote connection and subsequent user actions across that connection could enable attackers to effect a system breach and cause damage to resources therein:

(i) establishes usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and,

(ii) authorizes remote access to the information system prior to allowing such connections.

[Test: CA-6.1 - Security Authorization]

Failure to meet the security authorization requirements listed below could lead to compromise of the system or of the data in the system:

(i) the organization assigns a senior-level executive or manager to the role of authorizing official for the information system;

(ii) the authorizing official authorizes the information system for processing before commencing operations;

(iii) the organization defines the frequency of security authorization updates; and

(iv) the organization updates the security authorization in accordance with an organization-defined frequency.

[Test: CA-1(DHS-3.18.e) - Usage of Public Cloud Service Provider]

[Test: SC-20.1 - Secure Name / Address Resolution Service(Authoritative Source)]

Failure to meet the requirements for secure name / address resolution service(authoritative source) listed below could lead to the disclosure of sensitive information or to the disruption of critical mission/business functions, services, and operations/processes.

(i) the organization provides additional data origin and integrity artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

(ii) the organization provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

[Test: CM-11.1 - User-Installed Software]

Failure to meet the user-Installed software requirements listed below could weaken the overall security posture of the system:

(i) the organization establishes organization-defined policies governing the installation of software by users;

(ii) the organization enforces software installation policies through organization-defined methods; and,

(iii) the organization monitors policy compliance at an organization-defined frequency.

[Test: CA-3(DHS-5.4.3.b) - Interconnection Establishment Procedures]

Failure to meet the security requirements listed below could lead to compromise of the system or of the data in the system:

(i) the organization identifies connections to non-DHS information systems (i.e., information systems outside of the authorization boundary);

(ii) the organization authorizes connections between DHS and non-DHS systems through the use of controlled interfaces and approved service providers;

(iii) the organization documents interagency agreements, memorandums of understanding, service level agreements or interconnection security agreements, whenever system connection is made with other Federal agencies; and,

(iv) the organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements.

[Test: SC-1(DHS-5.5.2.t) - Use of PKI]

Failure to meet the requirements for using PKI listed below could lead to non-compliance with the entity’s policies, procedures, privacy requirements, agreements or contracts:

(i ) the organization ensures that commercial applications or appliances used by DHS that require the use of PKI certificates obtain their certificates from the DHS Principal CA or a DHS Component Internal Use NPE CA, as appropriate.

(ii) the organization ensures that commercial applications or appliances, that require the use of a proprietary CA implemented as an internal feature, are not acquired or used, unless prior concurrence by the DHS PKIMA and approval by the DHS PKIPA are obtained.

[Test: SI-1(DHS-5.4.2.a) - Continuous Monitoring of Networks]

[Test: AC-2.1 - Account Management]

Failure to meet the account management requirements listed below could enable an intruder to gain access to a system account through social engineering or other methods and elevate the account's rights to a higher privileged account to try and penetrate the system and cause intentional or unintentional damage:

(i) the organization identifies information system accounts to support organizational missions/business functions;

(ii) the organization assigns account managers for information system accounts;

(iii) the organization establishes conditions for group and role membership;

(iv) the organization specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

(v) the organization requires approvals by organization-defined personnel or roles for requests to create information system accounts;

(vi) the organization creates, enables, modifies, disables, and removes information system accounts;

(vii) the organization authorizes, and monitors the use of, information system accounts;

(viii) the organization notifies account managers:

· When accounts are no longer required;

· When users are terminated or transferred; and,

· When individual information system usage or need-to-know changes;

(ix) the organization authorizes access to the information system based on:

· A valid access authorization;

· Intended system usage; and,

· Other attributes as required by the organization or associated missions/business functions;

(x) the organization reviews accounts for compliance with account management requirements in accordance with organization-defined frequency; and,

(xi) the organization establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

[Test: PL-4(DHS-4.1.2.a) - DHS Rules of Behavior]

Failure to meet the rules of behavior requirements listed below could leave the users unaware of the required behavior with regard to information usage, which could lead to the user inadvertently abusing the information system resources:

(i) the components establish the rules that describe information system user responsibilities and expected behavior with regard to information and information system usage;

(ii) the components make the rules available to all information system users; and

(iii) the components receive a signed acknowledgement from users indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system.

[Test: SC-1(DHS-4.5.3.b) - Transmission Controls]

[Test: MP-2.1 - Media Access]

[Test: SC-1(DHS-5.7.a) - Information Assurance Considerations]

Failure to meet the requirements below could lead to ineffectively remediate information security weaknesses:

(i) Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmits sensitive or national security information.

(ii) IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial off-the-shelf (COTS) IA and IA-enabled IT products.

(iii) The products are provided for the availability of systems.

(iv) The products ensured the integrity and confidentiality of information and the authentication and nonrepudiation of parties in electronic transactions.

[Test: SC-7(DHS-5.4.4.h) - Permitted Protocols and Services for Component PEPs]

Failure to meet the requirements listed below could lead to an attacker or a malicious user gaining unauthorized access to the system or data and could risk the loss of critical DHS assets.

(i) components determined protocols and services permitted through their Component-level PEPs.

(ii) components may restrict traffic sources and destinations at their Component-level PEPs.

[Test: TR-1.1 - Privacy Notice]

Failure to meet the privacy notice requirements listed below increases the risk to unauthorized disclosure of personally identifiable information:

(i) the organization provides effective notice to the public and to individuals regarding:

· its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII);

· authority for collecting PII;

· the choices, if any, individuals may have regarding how the organization uses PII and the consequences of exercising or not exercising those choices; and

· the ability to access and have PII amended or corrected if necessary;

(ii) the organization describes:

· the PII the organization collects and the purpose(s) for which it collects that information;

· how the organization uses PII internally;

· whether the organization shares PII with external entities, the categories of those entities, and the purposes for such sharing;

· whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent;

· how individuals may obtain access to PII; and

· how the PII will be protected; and

(iii) the organization revises its public notices to reflect changes in practice or policy that affect PII or changes in its activities that impact privacy, before or as soon as practicable after the change.

[Test: AU-11.1 - Audit Record Retention]

Failure to meet the audit record retention requirements listed below could result in the loss of the generated audit data, which could render an audit or forensic investigation efforts useless:

(i) the organization defines the retention period for audit records;

(ii) the retention period for audit records is consistent with the records retention policy; and,

(iii) the organization retains audit records for the organization-defined time period consistent with the records retention policy to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

[Test: SI-1(DHS-5.4.6.h) - Email Monitoring for Spam]

[Test: PE-15.1 - Water Damage Protection]

[Test: CP-9.1 - Information System Backup]

[Test: CP-9.2 - Information System Backup]

Not Entered Failure of the organization to protect backup information at the designated storage locations could lead to the disruption of critical mission/business functions, operations, and processes.

Failure to meet the information system backup requirements listed below could affect the media reliability and information integrity:

(i) the organization defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives;

(ii) the organization defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives;

(iii) the organization defines the frequency of conducting information system documentation backups (including security-related information) to support recovery time objectives and recovery point objectives;

(iv) the organization backs up user-level information in accordance with the organization-defined frequency;

(v) the organization backs up system-level information in accordance with the organization-defined frequency; and

(vi) the organization backs up information system documentation in accordance with the organization-defined frequency.

Not Entered

[Test: CP-9.2 - Information System Backup]

[Test: AC-8.1 - System Use Notification]

[Test: AC-8.2 - System Use Notification]

Not Entered Failure of the information system notification message to include topics such as the ones indicated below could further encourage an attacker to try and break into the system:

(i) the organization approves the information system use notification message or banner to be displayed by the information system before granting access to the system;

(ii) the information system displays the approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

· users are accessing a U.S. Government information system;

· system usage may be monitored, recorded, and subject to audit;

· unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

· use of the system indicates consent to monitoring and recording; and

(iii) the information system retains the notification message or banner on the screen until the user takes explicit actions to log on to or further access the information system.

Failure to meet the system use notification requirements listed below could further encourage an attacker to try and break into the system due to low security policies:

(i) the information system (for publicly accessible systems) displays the system use information when appropriate, before granting further access;

(ii) the information system (for publicly accessible systems) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

(iii) the information system (for publicly accessible systems) includes in the notice given to public users of the information system, a description of the authorized uses of the information system.

Not Entered

[Test: AC-8.2 - System Use Notification]

[Test: SA-1(DHS-3.3.a) - Statements of Work]

[Test: SC-15(DHS-4.5.3.b) - Video Teleconference Protections]

[Test: SC-13(DHS-5.5.1.c) - Encryption Compliance with FIPS 197 and FIPS 140-2]

[Test: AR-1.1 - Governance and Privacy Program]

Failure to meet the governance and privacy program requirements listed below could leave the organization unprepared for any incident when it occurs, which could lead to the compromise or unauthorized disclosure of personally identifiable information:

(i) the organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems;

(ii) the organization monitors federal privacy laws and policy for changes that affect the privacy program;

(iii) the organization allocates sufficient budget and staffing resources to implement and operate the organization-wide privacy program;

(iv) the organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures;

(v) the organization develops, disseminates, and implements operational privacy policies and procedures that govern the appropriate privacy and security controls for programs, information systems, or technologies involving PII; and,

(vi) the organization updates privacy plan, policies, and procedures at least biennially.

[Test: SA-4(10).1 - Use Of Approved Piv Products]

[Test: CM-10.1 - Software Usage Restrictions]

Failure to meet the software usage restriction requirements listed below could weaken the overall security posture of the system:

(i) the organization uses software and associated documentation in accordance with contract agreements and copyright laws;

(ii) the organization tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and,

(iii) the organization controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

[Test: PE-12.1 - Emergency Lighting]

[Test: RA-2.1 - Security Categorization]

Failure to meet the risk assessment policy and procedures requirements listed below could result in incomplete and ineffective risk assessment policy, which could lead eventually to the loss of critical mission/business assets or to the disruption of organization operations, functions and services:

(i) the organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;

(ii) the organization documents the security categorization results (including supporting rationale) in the security plan for the information system; and

(iii) the organization ensures that the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative.

[Test: PM-11.1 - Mission/Business Process Definition]

Failure to meet the mission/business process definition requirements listed below could result in the disclosure of critical/sensitive information or data, which could eventually lead to the loss of organizational assets or to the disruption of critical mission/business functions, services, and operations/processes:

(i) the organization defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and

(ii) the organization determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until an achievable set of protection needs is obtained.

[Test: PE-6.1 - Monitoring Physical Access]

Failure to meet the requirements for monitoring physical access listed below could lead to the compromise of the system or of the data in the system:

(i) the organization monitors physical access to the facility where the information system resides to detect and respond to physical security incidents;

(ii) the organization reviews physical access logs organization-defined frequency and upon occurrence of organization-defined events or potential indications of events; and

(iii) the organization coordinates results of reviews and investigations with the organizational incident response capability.

[Test: AC-18.1 - Wireless Access]

Failure to meet the wireless access restrictions requirements indicated below could result in a number of unmanaged and unauthorized wireless access to the information system:

(i) the organization establishes usage restrictions and implementation guidance for wireless access;

(ii) the organization monitors for unauthorized wireless access to the information system;

(iii) the organization authorizes wireless access to the information system prior to connection; and

(iv) the organization enforces requirements for wireless connections to the information system.

[Test: SC-12(DHS-5.5.3.a) - DHS FPKI Human Subscriber]

[Test: SA-2.1 - Allocation of Resources]

Failure to meet the resource allocation requirement listed below could result in the organization lacking the required security control being acquired and implemented, which could cause the loss of critical mission/business assets or the disruption of organization operations, functions and services:

(i) the organization includes a determination of the information security requirements for the information system in mission/business process planning;

(ii) the organization determines, documents, and allocates the resources required to protect the information system as part of its capital planning and investment control process; and,

(iii) the organization establishes a discrete line item for information security in organizational programming and budgeting documentation.

[Test: IR-4.1 - Incident Handling]

Failure to meet the requirements for incident handling listed below could lead to the compromise of the system or of the data in the system:

(i) the organization implements an incident handling capability for security incidents that includes:

· preparation;

· detection and analysis;

· containment;

· eradication; and

· recovery;

(ii) the organization coordinates incident handling activities with contingency planning activities; and

(iii) the organization incorporates lessons learned from ongoing incident handling activities into:

· incident response procedures;

· training; and

· testing/exercises; and

(iv) the organization implements the resulting changes to incident response procedures, training and testing/exercise accordingly.

[Test: MP-7(DHS-4.3.1.e) - DHS owned Removable Media]

[Test: CA-3(DHS-5.4.3.n) - DHS Interconnections]

[Test: MA-4.1 - Nonlocal Maintenance]

Failure to meet the non-local maintenance requirements listed below could lead to the compromise of the system or of the data in the system:

(i) the organization authorizes, monitors, and controls non-local maintenance and diagnostic activities;

(ii) the organization documents, in the organizational policy and security plan for the information system, the acceptable conditions for allowing the use of non-local maintenance and diagnostic tools;

(iii) the organization allows the use of non-local maintenance and diagnostic tools only as consistent with organizational policy and as documented in the security plan;

(iv) the organization employs strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions;

(v) the organization maintains records for non-local maintenance and diagnostic activities; and

(vi) the organization (or information system in certain cases) terminates all sessions and network connections when non-local maintenance or diagnostics is completed.

[Test: AC-14.1 - Permitted Actions without Identification or Authentication]

Failure of the organization to identify and document specific user actions that can be performed on the information system without identification or authentication could further encourage an attacker to try and break into the system using such user actions not requiring identification and authentication:

(i) the organization identifies specific user actions that can be performed on the information system without identification or authentication; and

(ii) the organization documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication.

[Test: IA-8(1).1 - Acceptance Of PIV Credentials From Other Agencies]

Failure to meet the requirements of accepting PIV credentials listed below could result in providing any account access to critical or sensitive information:

(i) the information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies;

(ii) the organization implements logical access control systems (LACS) and physical access control systems (PACS); and,

(iii) the organization conforms to federal requirements when enabling agency-wide use of PIV credentials.

[Test: AC-17(DHS-5.4.1.c) - Remote Access of PII]

[Test: AU-4.1 - Audit Storage Capacity]

Failure to meet the audit storage capacity requirements indicated below could result in lost data, which could prove detrimental to the success of a forensic or audit report:

(i) the organization allocates audit record storage capacity; and,

(ii) the organization configures auditing to reduce the likelihood of audit record storage capacity being exceeded.

[Test: CA-6(DHS-3.9.h) - DHS Security Authorization]

Failure to meet the security authorization requirements listed below could lead to compromise of the system or of the data in the system:

(i) the components authorize systems at Initial Operating Capability, every three (3) years after, or whenever major changes occurs; and

(ii) an Authority to Operate (ATO) of six (6) months or less receives an ATO authorization period waiver from the DHS CISO before submission to the AO for the final decision.

[Test: RA-2(DHS-3.14.2.e) - Confidentiality for Privacy Systems]

[Test: IA-8(2).1 - Acceptance Of Third-Party Credentials]

[Test: AT-2.1 - Security Awareness Training]

Failure to meet the security awareness requirements indicated below could result in the organization's personnel's incomplete knowledge of the organization's security policy:

(i) the organization provides basic security awareness training to all information system users (including managers, senior executives, and contractors) as part of initial training for new users and when required by system changes;

(ii) the organization defines the frequency of refresher security awareness training; and,

(iii) the organization provides refresher security awareness training in accordance with the organization-defined frequency.

[Test: DM-2.1 - Data Retention and Disposal]

Failure to meet the data retention and disposal requirements listed below could result in the disclosure of critical and sensitive personally identifiable information:

(i) the organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection;

(ii) the organization limits the collection and retention of PII to the minimum elements identified for the purposes described in the notice and for which the individual has provided consent; and,

(iii) the organization conducts an initial evaluation of PII holdings and establishes and follows a schedule for regularly reviewing those holdings , at least annually, to ensure that only PII identified in the notice is collected and retained, and that the PII continues to be necessary to accomplish the legally authorized purpose.

[Test: CM-6(DHS-5.4.5.d) - Use of Telnet]

Failure to meet the requirements for configuration settings listed below could lead to the compromise of the system or of the data in the system:

(i) the organization does not authorize Telnet connections to any DHS computer;

(ii) the organization uses Secure Shell (SSH) connection protocols duly approved by the Component; and

(iii) the SSH employ any of the following secure authentication methods:

· two factor

· encrypted

· key exchange

[Test: PL-4(DHS-4.8.2.b) - Laptop Power Down]

[Test: AC-17(DHS-5.4.1.b) - Remote Access Connection Management]

Failure to meet the required remote access control policy and procedures listed below could result in a weaker security posture as a consequence of a failed audit process, the non-accountability of critical actions, and ignorance to the policy being implemented for the organization:

(i) the Components centrally manage all remote access and dial-in connections to their systems;

(ii) the Components ensure that remote access and approved dial-in capabilities provide the following access control mechanisms for sensitive information throughout transmission:

· strong authentication

· two-factor authentication

· audit capabilities

· protection

(ii) two-factor authentication is only allowed during remote access if one of the factors is provided by a device separate from the computer gaining access;

(iv) any two-factor authentication is based on Department-controlled certificates or hardware tokens issued directly to each authorized user; and

(v) remote access solutions comply with the encryption requirements of FIPS 140-2, Security Requirements for Cryptographic Modules.

[Test: MP-1(DHS-4.3.1.g)…