{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Purpose","Instructions","Audit Findings","Value List","RSK-# Determination"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Purpose","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Instructions","index":1,"n_rows":16,"n_cols":19,"rows_kept":16,"cut":false,"hidden":false,"merged":[[5,1,5,11],[7,1,7,11],[9,1,9,10],[13,1,13,9]]}
["Agency (Agency Name)","Name","Agency Finding Reference Field","Finding Submit Date","Finding","Affected Applications (Application Name)","Source Override","Policies (Section - Section Name)","Criticality","Magnitude of Impact","Probability of Occurrence","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Type","Actual Remediation Date","CSRM Tracking ID for Findings","Risk Register Helper","Exception Requests (Applicable Findings)"]
["Value Selection","Name of finding","Copy the name of this finding here","The date when the finding was submitted to CSRM. The date format is MM/DD/YYYY","Description of finding","List the applications affected by this finding. Separate the application name by semi-colons.","Identify if this is an Audit finding; \nValue Selection","SEC530 Policy ID.  You may select multiple values. \nValue Selection","What is the risk criticality for this finding? Will this risk have critical, high, moderate, or low rated selection?\nValue Selection","Will this risk have critical, high, moderate, or low impact?\nValue Selection","Will this risk have critical, high, moderate, or low impact?\nValue Selection","Description of remediation steps to be taken","When will the remediation be completed? The date format is MM/DD/YYYY.","Who is responsible for the remediation?  If listing multiple people, please separate them by semi-colons.\nJohn Doe (ISO); Mary Lamb (System Owner)","Value Selection","This date is used to calculate closure. The date format is MM/DD/YYYY.","*Optional* Use only if changing a current finding and add FND-#  If applicable, provide the CSRM Tracking ID for the finding using FND-\"12345\"\n*Note to not include FND- part and only the number.","Risk Register Selector - See Risk # Determination tab to see which is applicable. Value Selection"]
[]
[]
[null,"Instructions:"]
[null,"Please fill out Audit Findings tab and send to commonwealthsecurity@vita.virginia.gov and/or your CSRM Governance Analyst."]
[]
[null,"This sheet is intended to provide a description of each field header.  If it is labeled \"Value Selection\", that indicates that a value can be selected from a drop-down menu."]
[]
[null,"Also the Headings on each column will provide a description and any special colmumn formatting"]
[]
[null,"ISO's/designees need to enable macros to address column G.  For multiple risks, that will be addressed when your analyst completes the upload into Archer."]
[]
[null,"*NOTE* Determine whether the findings is based on family controls from SEC530 when completing the Policy - Section Name area. "]
[]
[null,"All columns highlighted in Dark Orange/Brown are required"]

{"sheet":"Audit Findings","index":2,"n_rows":1,"n_cols":19,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["Agency (Agency Name)","Name","Agency Finding Reference Field","Finding Submit Date","Finding","Affected Applications (Application Name)","Source Override","Policies (Section - Section Name)","Criticality","Magnitude of Impact","Probability of Occurence","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Type","Actual Remediation Date","CSRM Tracking ID for Findings","Risk Register Helper","Exception Requests (Applicable Findings):"]

{"sheet":"Value List","index":3,"n_rows":362,"n_cols":7,"rows_kept":362,"cut":false,"hidden":false,"merged":[]}
["Agency Name","Risk Values","Policy - Section Name","Source Override","Remediation Status","Risk Register","Type"]
["Alcoholic Beverage Control","Critical","SEC530 AC-1 - Access Control Policy and Procedures","Audit","Not Started","RSK-1","Control"]
["ATOS","High","SEC530 AC-2 - Account Management",null,"Underway","RSK-2","Management Action"]
["Board of Accountancy","Moderate","SEC530 AC-2-CE - Account Management",null,"Complete","RSK-3 ","Policy"]
["Board of Bar Examiners","Low","SEC530 AC-2-COV - Account Management",null,null,"RSK-4"]
["Center for Innovative Technologies",null,"SEC530 AC-2-COV-CE - Account Management",null,null,"RSK-5"]
["Commonwealths Attorneys Services Council",null,"SEC530 AC-3 - Access Enforcement",null,null,"RSK-6"]
["Compensation Board",null,"SEC530 AC-3-CE - Access Enforcement",null,null,"RSK-7"]
["Department for Aging and Rehabilitative Services",null,"SEC530 AC-4 - Information Flow Enforcement",null,null,"RSK-8"]
["Department for the Deaf and Hard of Hearing",null,"SEC530 AC-5 - Separation of Duties",null,null,"RSK-9"]
["Department of Accounts",null,"SEC530 AC-6 - Least Privilege",null,null,"RSK-10"]
["Department of Aviation",null,"SEC530 AC-6-CE - Least Privilege",null,null,"RSK-11"]
["Department of Behavioral Health and Development Services",null,"SEC530 AC-7 - Unsuccessful Login Attempts",null,null,"RSK-12"]
["Department of Blind and Visually Impaired",null,"SEC530 AC-7-CE - Unsuccessful Login Attempts",null,null,"RSK-13"]
["Department of Conservation and Recreation",null,"SEC530 AC-8 - System Use Notification",null,null,"RSK-14"]
["Department of Corrections",null,"SEC530 AC-8-COV - System Use Notification",null,null,"RSK-15"]
["Department of Criminal Justice Services",null,"SEC530 AC-10 - Concurrent Session Control",null,null,"RSK-16"]
["Department of Education",null,"SEC530 AC-11 - Device Lock",null,null,"RSK-17"]
["Department of Elections",null,"SEC530 AC-11-CE - Device Lock",null,null,"RSK-18"]
["Department of Environmental Quality",null,"SEC530 AC-12 - Session termination",null,null,"RSK-19"]
["Department of Fire Programs",null,"SEC530 AC-12-CE - Session termination",null,null,"RSK-20"]
["Department of Forensic Science",null,"SEC530 AC-14 - Permitted Actions Without Identification Or Authentication",null,null,"RSK-21"]
["Department of Forestry",null,"SEC530 AC-17 - Remote Access",null,null,"RSK-22"]
["Department of General Services",null,"SEC530 AC-17-CE - Remote Access",null,null,"RSK-23"]
["Department of Health Professions",null,"SEC530 AC-17-COV - Remote Access",null,null,"RSK-24"]
["Department of Historic Resources",null,"SEC530 AC-18 - Wireless Access",null,null,"RSK-25"]
["Department of Housing and Community Development",null,"SEC530 AC-18-CE - Wireless Access",null,null,"RSK-26"]
["Department of Human Resource Management",null,"SEC530 AC-18-COV - Wireless Access",null,null,"RSK-27"]
["Department of Juvenile Justice",null,"SEC530 AC-19 - Access Control for Mobile Devices"]
["Department of Labor and Industry",null,"SEC530 AC-19-CE - Access Control for Mobile Devices"]
["Department of Medical Assistance Services",null,"SEC530 AC-20 - Use of External Information Systems"]
["Department of Military Affairs",null,"SEC530 AC-20-CE - Use of External Information Systems"]
["Department of Mines, Minerals and Energy",null,"SEC530 AC-20-COV - Use of External Information Systems"]
["Department of Motor Vehicles",null,"SEC530 AC-21 - Information Sharing"]
["Department of Planning and Budget",null,"SEC530 AC-21-CE - Information Sharing"]
["Department of Professional and Occupational Regulation",null,"SEC530 AC-22 - Publicly Accessible Content"]
["Department of Rail and Public Transportation",null,"SEC530 AT-1 - Security Awareness and Training Policy and Procedures"]
["Department of Small Business and Supplier Diversity",null,"SEC530 AT-2 - Literacy Training and Awareness"]
["Department of Social Services",null,"SEC530 AT-2-CE - Literacy Training and Awareness"]
["Department of Taxation",null,"SEC530 AT-2-COV - Literacy Training and Awareness"]
["Department of Treasury",null,"SEC530 AT-3 - Roled-Based Training"]
["Department of Veterans Services",null,"SEC530 AT-3-CE - Roled-Based Training"]
["Department of Wildlife Resources",null,"SEC530 AT-4 - Training Records"]
["Frontier Culture Museum of Virginia",null,"SEC530 AT-6 - Training Feedback"]
["Gunston Hall",null,"SEC530 AU-1 - Audit and Accountability Policy and Procedures"]
["Indigent Defense Commission",null,"SEC530 AU-2 - Events Logging"]
["Iron Bow",null,"SEC530 AU-3 - Content of Audit Records"]
["Jamestown-Yorktown Foundation",null,"SEC530 AU-3-CE - Content of Audit Records"]
["Library of Virginia",null,"SEC530 AU-4 - Audit Storage Capacity"]
["Marine Resources Commission",null,"SEC530 AU-4-CE - Audit Storage Capacity"]
["Motor Vehicle Dealer Board",null,"SEC530 AU-5 - Response To Audit Processing Failures"]
["New College Institute",null,"SEC530 AU-5-CE - Response To Audit Processing Failures"]
["Norfolk State University",null,"SEC530 AU-6 - Audit Review, Analysis, and Reporting"]
["Office of Attorney General",null,"SEC530 AU-6-CE - Audit Review, Analysis, and Reporting"]
["Office of Children's Services",null,"SEC530 AU-8 - Time Stamps"]
["Office of Data Governance and Analytics",null,"SEC530 AU-9 - Protection of Audit Information"]
["Office of State Inspector General",null,"SEC530 AU-9-CE - Protection of Audit Information"]
["Office of the Governor",null,"SEC530 AU-11 - Audit Record Retention"]
["Peraton",null,"SEC530 AU-12 - Audit Record Generation"]
["Richard Bland College ",null,"SEC530 AU-12-CE - Audit Record Generation"]
["SAIC",null,"SEC530 AU-13 - Monitoring for Information Disclosure"]
["Science Museum of Virginia",null,"SEC530 CA-1 - Security Assessment and Authorization Policies and Procedures"]
["Southern Virginia Higher Education Center",null,"SEC530 CA-2 - Security Assessments"]
["Southwest Virginia Higher Education Center",null,"SEC530 CA-2-CE - Security Assessments"]
["State Corporation Commission",null,"SEC530 CA-3 - Information Exchange"]
["State Council of Higher Education for Virginia",null,"SEC530 CA-3-COV - Information Exchange"]
["State Lottery Department",null,"SEC530 CA-5 - Plan of Action and Milestones"]
["Tempus Nova",null,"SEC530 CA-6 - Authorization"]
["Tobacco Region Revitalization Commission",null,"SEC530 CA-7 - Continuous Monitoring"]
["Unisys",null,"SEC530 CA-7-CE - Continuous Monitoring"]
["Verizon",null,"SEC530 CA-8 - Penetration Testing"]
["Virginia College Savings Plan",null,"SEC530 CA-9 - Internal system Connections"]
["Virginia Commission for the Arts",null,"SEC530 CA-9-CE - Internal system Connections"]
["Virginia Department of Agriculture and Consumer Services",null,"SEC530 CM-1 - Configuration Management Policy and Procedures"]
["Virginia Department of Emergency Management",null,"SEC530 CM-2 - Baseline Configuration"]
["Virginia Department of Health",null,"SEC530 CM-2-CE - Baseline Configuration"]
["Virginia Department of Transportation",null,"SEC530 CM-2-COV - Baseline Configuration"]
["Virginia Economic Development Partnership",null,"SEC530 CM-3 - Configuration Change Control"]
["Virginia Employment Commission",null,"SEC530 CM-3-CE - Configuration Change Control"]
["Virginia Energy",null,"SEC530 CM-3-COV - Configuration Change Control"]
["Virginia Foundation for Healthy Youth",null,"SEC530 CM-4 - Impact Analysis"]
["Virginia Information Technologies Agency",null,"SEC530 CM-4-CE - Impact Analysis"]
["Virginia Museum of Fine Arts",null,"SEC530 CM-5 - Access Restrictions for Change"]
["Virginia Museum of Natural History",null,"SEC530 CM-5-CE - Access Restrictions for Change"]
["Virginia Racing Commission",null,"SEC530 CM-6 - Configuration Settings"]
["Virginia Resources Authority",null,"SEC530 CM-7 - Least Functionality"]
["Virginia Retirement System",null,"SEC530 CM-7-CE - Least Functionality"]
["Virginia School for the Deaf and Blind",null,"SEC530 CM-8 - System Component Inventory"]
["Virginia State Police",null,"SEC530 CM-8-CE - System Component Inventory"]
["Virginia State University",null,"SEC530 CM-9 - Configuration Management Plan"]
["Virginia Workers Compensation Commission",null,"SEC530 CM-9-CE - Configuration Management Plan"]
["Virginia Works - DWDA",null,"SEC530 CM-10 - Software Usage Restrictions"]
["Wilson Workforce and Rehabilitation Center",null,"SEC530 CM-10-CE - Software Usage Restrictions"]
["Xerox",null,"SEC530 CM-11 - User installed software"]
[null,null,"SEC530 CM-11-CE - User installed software"]
[null,null,"SEC530 CP-1 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-1-COV-1 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-1-COV-2 - Contingency Planning Policy and Procedures"]
[null,null,"SEC530 CP-2 - Contingency Plan"]
[null,null,"SEC530 CP-2-CE - Contingency Plan"]
[null,null,"SEC530 CP-3 - Contingency Training"]
[null,null,"SEC530 CP-3-CE - Contingency Training"]
[null,null,"SEC530 CP-4 - Contingency Plan Testing"]
[null,null,"SEC530 CP-4-CE - Contingency Plan Testing"]
[null,null,"SEC530 CP-6 - Alternate Storage Site"]
[null,null,"SEC530 CP-6-CE - Alternate Storage Site"]
[null,null,"SEC530 CP-7 - Alternate Processing Site"]
[null,null,"SEC530 CP-7-CE - Alternate Processing Site"]
[null,null,"SEC530 CP-8 - Telecommunications Services"]
[null,null,"SEC530 CP-8-CE - Telecommunications Services"]
[null,null,"SEC530 CP-9 - Information System Backup"]
[null,null,"SEC530 CP-9-CE - Information System Backup"]
[null,null,"SEC530 CP-9-COV - Information System Backup"]
[null,null,"SEC530 IA-1 - Identification and Authentication Policy and Procedures"]
[null,null,"SEC530 IA-2 - Identification and Authentication (Organizational Users)"]
[null,null,"SEC530 IA-2-CE - Identification and Authentication (Organizational Users)"]
[null,null,"SEC530 IA-4 - Identifier Management"]
[null,null,"SEC530 IA-4-CE - Identifier Management"]
[null,null,"SEC530 IA-5 - Authenticator Management"]
[null,null,"SEC530 IA-5-CE - Authenticator Management"]
[null,null,"SEC530 IA-5-COV-01 - Authenticator Management"]
[null,null,"SEC530 IA-5-COV-02 - Authenticator Management"]
[null,null,"SEC530 IA-6 - Authenticator Feedback"]
[null,null,"SEC530 IA-7 - Cryptographic Module Authentication"]
[null,null,"SEC530 IA-8 - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-8-CE - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-8-COV - Identification and Authentication (Non-organizational Users)"]
[null,null,"SEC530 IA-9 - Service Identification and Authentication"]
[null,null,"SEC530 IA-11 - Re-Authentication"]
[null,null,"SEC530 IA-12 - Identity Proofing"]
[null,null,"SEC530 IA-12-CE - Identity Proofing"]
[null,null,"SEC530 IR-1 - Incident Response Policy and Procedures"]
[null,null,"SEC530 IR-1-COV - Incident Response Policy and Procedures"]
[null,null,"SEC530 IR-2 - Incident Response Training"]
[null,null,"SEC530 IR-2-CE - Incident Response Training"]
[null,null,"SEC530 IR-3 - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-3-CE - Incident Response Testing and Exercises"]
[null,null,"SEC530 IR-4 - Incident Handling"]
[null,null,"SEC530 IR-4-CE - Incident Handling"]
[null,null,"SEC530 IR-4-COV-1 - Incident Handling"]
[null,null,"SEC530 IR-4-COV-2 - Incident Handling"]
[null,null,"SEC530 IR-5 - Incident Monitoring"]
[null,null,"SEC530 IR-5-CE - Incident Monitoring"]
[null,null,"SEC530 IR-6 - Incident Reporting"]
[null,null,"SEC530 IR-6-CE - Incident Reporting"]
[null,null,"SEC530 IR-6-COV - Incident Reporting"]
[null,null,"SEC530 IR-7 - Incident Response Assistance"]
[null,null,"SEC530 IR-7-CE - Incident Response Assistance"]
[null,null,"SEC530 IR-8 - Incident Response Plan"]
[null,null,"SEC530 IR-8-CE - Incident Response Plan"]
[null,null,"SEC530 MA-1 - System Maintenance Policy and Procedures"]
[null,null,"SEC530 MA-2 - Controlled Maintenance"]
[null,null,"SEC530 MA-3 - Maintenance Tools"]
[null,null,"SEC530 MA-3-CE - Maintenance Tools"]
[null,null,"SEC530 MA-4 - Nonlocal Maintenance"]
[null,null,"SEC530 MA-4-CE - Nonlocal Maintenance"]
[null,null,"SEC530 MA-5 - Maintenance Personnel"]
[null,null,"SEC530 MA-5-COV - Maintenance Personnel"]
[null,null,"SEC530 MA-6 - Timely Maintenance"]
[null,null,"SEC530 MA-6-CE - Timely Maintenance"]
[null,null,"SEC530 MP-1 - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-1-COV - Media Protection Policy and Procedures"]
[null,null,"SEC530 MP-2 - Media Access"]
[null,null,"SEC530 MP-3 - Media Marking"]
[null,null,"SEC530 MP-4 - Media Storage"]
[null,null,"SEC530 MP-5 - Media Transport"]
[null,null,"SEC530 MP-5-CE - Media Transport"]
[null,null,"SEC530 MP-6 - Media Sanitization"]
[null,null,"SEC530 MP-6-CE - Media Sanitization"]
[null,null,"SEC530 MP-6-COV - Media Sanitization"]
[null,null,"SEC530 MP-7 - Media Use"]
[null,null,"SEC530 MP-7-CE - Media Use"]
[null,null,"SEC530 PE-01 - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-1-COV - Physical and Environmental Protection Policy and Procedures"]
[null,null,"SEC530 PE-2 - Physical Access Authorizations"]
[null,null,"SEC530 PE-2-CE - Physical Access Authorizations"]
[null,null,"SEC530 PE-2-COV - Physical Access Authorizations"]
[null,null,"SEC530 PE-3 - Physical Access Control"]
[null,null,"SEC530 PE-3-CE - Physical Access Control"]
[null,null,"SEC530 PE-3-COV - Physical Access Control"]
[null,null,"SEC530 PE-4 - Access Control for Transmission Medium"]
[null,null,"SEC530 PE-5 - Access Control for Output Devices"]
[null,null,"SEC530 PE-6 - Monitoring Physical Access"]
[null,null,"SEC530 PE-6-CE - Monitoring Physical Access"]
[null,null,"SEC530 PE-8 - Visitor Access Records"]
[null,null,"SEC530 PE-9 - Power Equipment and Power Cabling"]
[null,null,"SEC530 PE-9-CE - Power Equipment and Power Cabling"]
[null,null,"SEC530 PE-10 - Emergency Shutoff"]
[null,null,"SEC530 PE-11 - Emergency Power"]
[null,null,"SEC530 PE-11-CE - Emergency Power"]
[null,null,"SEC530 PE-13 - Fire Protection"]
[null,null,"SEC530 PE-13-CE - Fire Protection"]
[null,null,"SEC530 PE-14 - Environmental Controls"]
[null,null,"SEC530 PE-14-CE - Environmental Controls"]
[null,null,"SEC530 PE-15 - Water Damage Protection"]
[null,null,"SEC530 PE-15-CE - Water Damage Protection"]
[null,null,"SEC530 PE-16 - Delivery and Removal"]
[null,null,"SEC530 PE-17 - Alternate Work Site"]
[null,null,"SEC530 PE-18 - Location of System Components"]
[null,null,"SEC530 PE-18-COV - Location of Information System Components"]
[null,null,"SEC530 PE-23 - Facility Location"]
[null,null,"SEC530 PL-1 - Planning Policy and Procedures"]
[null,null,"SEC530 PL-2 - System Security and Privacy Plan"]
[null,null,"SEC530 PL-2-COV - System Security and Privacy Plan"]
[null,null,"SEC530 PL-4 - Rules of Behavior"]
[null,null,"SEC530 PL-4-CE - Rules of Behavior"]
[null,null,"SEC530 PL-4-COV - Rules of Behavior"]
[null,null,"SEC530 PL-8 - Security and Privacy Architecture"]
[null,null,"SEC530 PL-8-CE - Security and Privacy Architecture"]
[null,null,"SEC530 PL-9 - Central Management"]
[null,null,"SEC530 PL-10 - Baseline Selection"]
[null,null,"SEC530 PL-11 - Baseline Tailoring"]
[null,null,"SEC530 PM-1 - Information Security Program Plan"]
[null,null,"SEC530 PM-2 - Information Security Program Leadership Role"]
[null,null,"SEC530 PM-3 - Information Security and Privacy Resources"]
[null,null,"SEC530 PM-4 - Plan Action and Milestones Process"]
[null,null,"SEC530 PM-5 - System Inventory"]
[null,null,"SEC530 PM-5-CE - System Inventory"]
[null,null,"SEC530 PM-6 - Measures of Performance"]
[null,null,"SEC530 PM-7 - Enterprise Architecture"]
[null,null,"SEC530 PM-8 - Critical Infrastructure Plan"]
[null,null,"SEC530 PM-9 - Risk Management Strategy"]
[null,null,"SEC530 PM-10 - Authorization Process"]
[null,null,"SEC530 PM-11 - Mission and Business Process Definition"]
[null,null,"SEC530 PM-14 - Testing Training and Monitoring"]
[null,null,"SEC530 PM-25 - Minimization of Personally Identifiacble Information Used in Testing Training and Research"]
[null,null,"SEC530 PM-28 - Risk Framing"]
[null,null,"SEC530 PM-31 - Continous Monitoring Strategy"]
[null,null,"SEC530 PM-32 - Purposing"]
[null,null,"SEC530 PS-1 - Personnel Security Policy and Procedures"]
[null,null,"SEC530 PS-3 - Personnel Screening"]
[null,null,"SEC530 PS-4 - Personnel Termination"]
[null,null,"SEC530 PS-5 - Personnel Transfer"]
[null,null,"SEC530 PS-6 - Access Agreements"]
[null,null,"SEC530 PS-7 - External Personnel Security"]
[null,null,"SEC530 PS-8 - Personnel Sanctions"]
[null,null,"SEC530 PS-9 - Position Descriptions"]
[null,null,"SEC530 RA-1 - Risk Assessment Policy and Procedures"]
[null,null,"SEC530 RA-2 - Security Categorization"]
[null,null,"SEC530 RA-2-CE - Security Categorization"]
[null,null,"SEC530 RA-3 - Risk Assessment"]
[null,null,"SEC530 RA-3-CE - Risk Assessment"]
[null,null,"SEC530 RA-5 - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-5-CE - Vulnerability Monitoring and Scanning"]
[null,null,"SEC530 RA-9 - Criticality Analysis"]
[null,null,"SEC530 RA-10 - Threat Hunting"]
[null,null,"SEC530 SA-01 - Systems & Services Acquisitions Policies"]
[null,null,"SEC530 SA-2 - Allocation of Resources"]
[null,null,"SEC530 SA-3 - System Development Life Cycle"]
[null,null,"SEC530 SA-3-CE - System Development Life Cycle"]
[null,null,"SEC530 SA-3-COV-1 - Life Cycle Support"]
[null,null,"SEC530 SA-3-COV-2 - Life Cycle Support"]
[null,null,"SEC530 SA-4 - Acquisitions"]
[null,null,"SEC530 SA-4-CE - Acquisitions"]
[null,null,"SEC530 SA-4-COV-1 - Acquisitions"]
[null,null,"SEC530 SA-5 - System Documentation"]
[null,null,"SEC530 SA-6-COV - Software Usage Restrictions"]
[null,null,"SEC530 SA-8 - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-8-CE - Security and Privacy Engineering Principles"]
[null,null,"SEC530 SA-9 - External System Services"]
[null,null,"SEC530 SA-9-CE - External System Services"]
[null,null,"SEC530 SA-9-COV-1 - External System Services"]
[null,null,"SEC530 SA-9-COV-2 - External System Services"]
[null,null,"SEC530 SA-9-COV-3 - External System Services"]
[null,null,"SEC530 SA-10 - Developer Configuration Management"]
[null,null,"SEC530 SA-10-CE - Developer Configuration Management"]
[null,null,"SEC530 SA-11 - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-11-CE - Developer Testing and Evaluation"]
[null,null,"SEC530 SA-15 - Development Process Standards and Tools"]
[null,null,"SEC530 SA-15-CE - Development Process Standards and Tools"]
[null,null,"SEC530 SA-16 - Developer-Provided Training"]
[null,null,"SEC530 SA-17 - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-17-CE - Developer Security and Privacy Architecture & Design"]
[null,null,"SEC530 SA-22 - Unsupported System Components"]
[null,null,"SEC530 SC-1 - System and Communications Protection Policy and Procedures"]
[null,null,"SEC530 SC-2 - Separation of System and User Functionality"]
[null,null,"SEC530 SC-2-CE - Separation of System and User Functionality"]
[null,null,"SEC530 SC-3 - Security Function Isolation"]
[null,null,"SEC530 SC-4 - Information In Shared System Resources"]
[null,null,"SEC530 SC-5 - Denial-of-Service Protection"]
[null,null,"SEC530 SC-5-CE - Denial-of-Service Protection"]
[null,null,"SEC530 SC-6 - Resource Availability"]
[null,null,"SEC530 SC-7 - Boundary Protection"]
[null,null,"SEC530 SC-7-CE - Boundary Protection"]
[null,null,"SEC530 SC-8 - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-CE - Transmission Confidentiality and Integrity"]
[null,null,"SEC530 SC-8-COV - Transmission Integrity"]
[null,null,"SEC530 SC-10 - Network Disconnect"]
[null,null,"SEC530 SC-12 - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-CE - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-12-COV - Cryptographic Key Establishment and Management"]
[null,null,"SEC530 SC-13 - Use of Cryptography"]
[null,null,"SEC530 SC-13-COV - Use of Cryptography"]
[null,null,"SEC530 SC-15 - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-15-CE - Collaborative Computing Devices and Applications"]
[null,null,"SEC530 SC-17 - Public Key Infrastructure Certificates"]
[null,null,"SEC530 SC-18 - Mobile Code"]
[null,null,"SEC530 SC-20 - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-20-CE - Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SEC530 SC-21 - Secure Name / Address Resolution Service (recursive or Caching Resolver)"]
[null,null,"SEC530 SC-22 - Architecture and Provisioning for Name/ Address Resolution Service"]
[null,null,"SEC530 SC-23 - Session Authenticity"]
[null,null,"SEC530 SC-23-CE - Session Authenticity"]
[null,null,"SEC530 SC-28 - Protection of Information At Rest"]
[null,null,"SEC530 SC-28-CE - Protection of Information At Rest"]
[null,null,"SEC530 SC-37 - Out of Band Channels"]
[null,null,"SEC530 SC-37-CE - Out of Band Channels"]
[null,null,"SEC530 SC-39 - Process Isolation"]
[null,null,"SEC530 SC-42 - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-CE - Sensor Capability and Data"]
[null,null,"SEC530 SC-42-COV - Sensor Capability and Data"]
[null,null,"SEC530 SC-43 - Usage Restrictions"]
[null,null,"SEC530 SC-44 - Detonation Chambers"]
[null,null,"SEC530 SC-45 - System Time Synchronization"]
[null,null,"SEC530 SC-45-CE - System Time Synchronization"]
[null,null,"SEC530 SC-46 - Cross Domain Policy Enforcement"]
[null,null,"SEC530 SC-47 - Alternate Communications Paths"]
[null,null,"SEC530 SC-50 - Software-Enforced Separation and Policy Enforcement"]
[null,null,"SEC530 SI-1 - System and Information Integrity Policy and Procedures"]
[null,null,"SEC530 SI-2 - Flaw Remediation"]
[null,null,"SEC530 SI-2-CE - Flaw Remediation"]
[null,null,"SEC530 SI-2-COV - Flaw Remediation"]
[null,null,"SEC530 SI-3 - Malicious Code Protection"]
[null,null,"SEC530 SI-3-CE - Malicious Code Protection"]
[null,null,"SEC530 SI-3-COV - Malicious Code Protection"]
[null,null,"SEC530 SI-4 - Information System Monitoring"]
[null,null,"SEC530 SI-4-CE - Information System Monitoring"]
[null,null,"SEC530 SI-5 - Security Alerts Advisories and Directives"]
[null,null,"SEC530 SI-6 - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-6-CE - Security and Privacy Function Verification"]
[null,null,"SEC530 SI-7 - Software Firmware and Information Integrity"]
[null,null,"SEC530 SI-7-CE - Software Firmware and Information Integrity"]
[null,null,"SEC530 SI-8 - Spam Protection"]
[null,null,"SEC530 SI-8-CE - Spam Protection"]
[null,null,"SEC530 SI-10 - Information Input Validation"]
[null,null,"SEC530 SI-10-CE - Information Input Validation"]
[null,null,"SEC530 SI-11 - Error handling"]
[null,null,"SEC530 SI-12 - Information Management and Retention"]
[null,null,"SEC530 SI-12-CE - Information Management and Retention"]
[null,null,"SEC530 SI-16 - Memory Protection"]
[null,null,"SEC530 SI-20 - Tainting"]
[null,null,"GOV-1.03 Roles and Responsibilities"]
[null,null,"GOV-1.04 Information Security Program"]
[null,null,"GOV-1.05 Exceptions to Security Requirements"]
[null,null,"GOV-1.06 Exemptions from Applicability"]
[null,null,"GOV-1.07 Determination of Liability"]
[null,null,"GOV-1.08 Revocation of Hosted Computing Permissions"]
[null,null,"GOV-2.02 CIO; Role"]
[null,null,"GOV-2.03 CISO; Role"]
[null,null,"GOV-2.04 Agency Head; Role"]
[null,null,"GOV-2.05 ISO; Role"]
[null,null,"GOV-2.06 Privacy Officer ; Role"]
[null,null,"GOV-2.07 System Owner; Role"]
[null,null,"GOV-2.08 Data Owner; Role"]
[null,null,"GOV-2.09 System Administrator; Role"]
[null,null,"GOV-2.10 Data Custodian; Role"]
[null,null,"GOV-2.11 IT System Users"]
[null,null,"GOV-3.x BIA Requirements"]
[null,null,"GOV-4.x IT System and Data Sensitivity Classification"]
[null,null,"GOV-5.x Sensitive IT System Inventory and Definition"]
[null,null,"GOV-6.x Risk Assessments"]
[null,null,"GOV-7.x IT Security Audits"]

{"sheet":"RSK-# Determination","index":4,"n_rows":32,"n_cols":6,"rows_kept":32,"cut":false,"hidden":false,"merged":[[1,0,4,0],[6,0,11,0],[13,0,17,0],[19,0,24,0],[27,0,30,0]]}
["Risk Grouping","RSK #","Risk","Risk Description","Threat Agent","Vulnerability"]
["Access and Authorization Risks","RSK-1","Repudiation","The inability to maintain accountability (eg, asset ownership, non-repudiation of actions or inactions)","Insider threats, cyber criminals, malware, software vulnerabilities","Weak Digital signatures, insufficient logging, poor time stamping, weak authentication, data integrity issues"]
[null,"RSK-2","Improper Assignment of Privileged Functions","Inability to implement least privileges (eg, Role Based Access, Privileged Account Management)","Insider threats, cyber criminals, malware, software vulnerabilities, negligent administrator","Unnecessary elevated privileges, default privileged accounts, insufficient role-based access controls (RBAC), Lack of privilege reviews, insecure configurations"]
[null,"RSK-3","Privilege Escalation","The inability to restrict access to privileged functions","Insider threats, cyber criminals, malware, social engineering, stolen credentials, misconfigurations","System misconfiguration, software vulnerabilities, weak passwords, improper access controls, kernel exploits, unsecured services, outdated software"]
[null,"RSK-4","Unauthorized Access","The inability to restrict access to only authorized individuals, groups or services, account termination","Insider Threats, Cyber criminals, organized crime groups, nation-state actors, Third Party Contractors, ","Weak passwords, lack of MFA, phishing attacks, unpatched software, misconfigurations, injection flaws, inadequate access controls, insider threat, unrevoked access, shared accounts, "]
[]
["Operational Risks","RSK-5","Mission Interruption","Interruption of COV mission critical business processes due to MEF and PBF not properly supported","Cyber attacks, natural disasters, infrastructure failures, human error, supply chain disruption, insider threats, insufficient capacity","Lack of redundancy, insufficient disaster recovery planning, poor change management, inadequate security controls, untested backups, supply chain weaknesses"]
[null,"RSK-6","Business Interruption","Increased latency, or a service outage, that negatively impact business operations.","Cyber attacks, natural disasters, infrastructure failures, human error, supply chain disruption, insider threats, insufficient capacity","Lack of redundancy, insufficient disaster recovery planning, poor change management, inadequate security controls, untested backups, supply chain weaknesses"]
[null,"RSK-7","Reduction in productivity","Diminished user productivity.","Underperforming vendor, cybercriminal, negligent contractor, Unreliable Supplier, Internal Misalignment","Third Party Downtime, Poor Integration, Inadequate Support, Over-Reliance, Lack of Training"]
[null,"RSK-8","Loss of revenue","A negative impact on the ability to generate revenue (e.g., a loss of clients or an inability to generate future revenue).","Third party vendor, cybercriminal, negligent contractor","Dependency on third parties, unsecured systems, lack of redundancy, poor contract terms, inadequate incident response"]
[null,"RSK-9","Fines and judgements ","Financial damages due to fines and/or judgements from statutory / regulatory / contractual non-compliance.","Third party service provider, cyber criminal, disgruntled contractor, federal/state regulator, public litigants","Lax vendor management, regulatory misalignment, unclear  accountability, physical security gaps, delayed reporting"]
[null,"RSK-10","Reputational damage","Diminished brand value (e.g., tarnished reputation).","Incompetent vendor, cyber criminal, negligent contractor, media/activists, Disgruntled Citizens","Lack of oversight, Third-Party Misconduct, Poor Communication, Over-Dependence (third party), data exposure"]
[]
["System and Data Risks","RSK-11","Data loss / corruption","The inability to maintain the confidentiality of the data (compromise) or prevent data destruction (loss).","Malicious threat actors, Non-malicious threat actors (accidental)","Human error, malware, hardware failure, network vulnerabilities, outdated software, weak authentication, phishing attacks, insider threats, power outages, natural disasters"]
[null,"RSK-12","Unmitigated vulnerabilities ","Unmitigated technical vulnerabilities that lack compensating controls or other mitigation actions.","Hackers; Organized crime groups; Nation State Actors, Insider Threats; Third Party Vendor","Unpatched Systems; Outdated Software, Poor configurations, delayed reporting, lack of oversight"]
[null,"RSK-13","System compromise ","A compromise of a system, application or service that affects confidentiality, integrity, availability and/or safety.","Hackers; Organized crime groups; Nation State Actors, Insider Threats (Malicious and Negligent); Script Kiddies","Unpatched Systems; Outdated Software; Weak Authentication; Weak Access Control; Cryptographic Vulnerabilities (missing data encryption, cryptographic failures, compromise of encryption keys); Human Error; Security Misconfigurations"]
[null,"RSK-14","Lost, damaged or stolen assets","Lost, damaged or stolen assets.","Insider threats, cyber criminals, mishandling data storage devices, mishandling laptops and mobile devices, lack of security awareness training","Unauthorized physical access, identity theft, unencrypted hardware, lack of device tracking, lack of remote wipe capabilities"]
[null,"RSK-15","Loss of data integrity","Unauthorized changes that corrupt the integrity of the system / application / service. ","Malicious threat actors, Non-malicious threat actors (accidental)","Human error, system failures, insufficient access controls, poor data validation, outdated software, backup issues"]
[]
["Supply Chain (Third Party)","RSK-16","Third-party cybersecurity exposure","Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from third-party cybersecurity practices, vulnerabilities and/or incidents that affects the supply chain through impacted products and/or services.","Compromised Vendor, malicious insider at third party, external hacker, nation-state actor","Misconfigurations; Weak Access Control; Unpatched Software; Outdated Software; Lack of Security training; Weak Authentication; Lack of Visibility into Vendor Security; Exploitation of Vendor Networks; Vulnerabilities in Third-Party Applications; unsecured data sharing"]
[null,"RSK-17","Third-party physical security exposure","Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from physical security exposure of third-party structures, facilities and/or other physical assets that affects the supply chain through impacted products and/or services.","Compromised Vendor, malicious insider at third party, compromised contractors, external criminal","Inadequate vetting, unrestricted access, poor credential management, weak perimeter controls, lack of oversight"]
[null,"RSK-18","Third-party supply chain relationships, visibility and controls","Loss of Confidentiality, Integrity, Availability and/or Safety (CIAS) from \"downstream\" third-party relationships, visibility and controls that affect the supply chain through impacted products and/or services.","Compromised Supplier, Cyber criminal, nation-state actor, negligent third party, insider threat","Limited Visibility, weak vetting, uncontrolled access, lack of standards enforcement, single source dependency"]
[null,"RSK-19","Third-party compliance / legal exposure","The inability to maintain compliance due to third-party non-compliance, criminal acts, or other relevant legal action(s).","Non-compliant vendor, cyber criminal, negligent contractor, regulatory authority, litigants","Inadequate Due Diligence, Unenforced Standards, Ambiguous Contracts, Poor Oversight, Data Sharing Risks"]
[null,"RSK-20","Misuse of product / service","The misuse of the product / service in a manner that it was not designed or how it was approved for use.","Faulty Vendor, Malicious Supplier, Cyber Criminal, Negligent Contractor, End User","Substandard Quality of Services, Security Flaws, Lack of Testing, Misaligned Usage, No Usage Oversight"]
[null,"RSK-21","Reliance on the third-party","The inability to continue business operations, due to the reliance on the third-party product and/or service. Lack of appropriate cyber liability insurance","Unreliable vendor, malicious actor, negligent contractor, competitor nation, regulatory body","Single point of failure, lack of alternatives, Opaque Operations (Limited visibility into third party performance), Weak Contracts, Resource Overstretch"]
[]
[null,"RSK-22","Unremediated Vulns","Organization is not able to remediate vulnerabilities/has shown themselves to not remediate vulnerabilities in a timely manner"]
["Organizational Program Risk","RSK-23","Compliance","A lack of compliance to COV information security standards reduces an agency's ability to measure and mitigate risk. ","Improper organizational reporting structure, lack of security prioritization","Hidden or Undocumented Systems; Inadequate roles/responsibilities training, lack of agency support"]
[null,"RSK-24","Compliance Reporting","Compliance reporting provides enterprise risk context and decision making","Improper organizational reporting structure, lack of security prioritization","Hidden or Undocumented Systems; Inadequate roles/responsibilities training, lack of agency support"]
[null,"RSK-25","InfoSec Structure","Information Security reporting issues, conflicts of interest, or separation of duties","Improper organizational reporting structure","Personnel constraints, lack of security knowledge from leadership"]
[null,"RSK-26","Legacy Software","The presence of legacy software or software that will become unsupported at some point","Hackers; Organized crime groups; Nation State Actors, Insider Threats; Script Kiddies; Cybercriminals","Outdated Security Measures; Lack of Vendor Support;  Lack of Built-in Security Features; Lack of Modern Security Tools; Exploitation of Outdated Protocols"]
[null,"RSK-27","Audit","This is an interim risk register item for linking to audit findings while work is done to clarify the requirements for linking audit findings to the new risk register, and for items that were previously linked to be savable."]