API tools faq
paste
Advertisement
Lulz_rooted

Sneak

Lulz_rooted
Dec 25th, 2013
731
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.45 KB | None | 0 0
raw download clone embed print report
  1. __ /\ __ __ /\ __ __ /\ __ __ /\ __
  2. \_`\/`_/ .\'/. \_`\/`_/ .\'/. \_`\/`_/ .\'/. \_`\/`_/
  3. <_>()<_>-=>*<=-<_>()<_>-=>*<=-<_>()<_>-=>*<=-<_>()<_>
  4. /_,/\,_\ '/.\' /_,/\,_\ '/.\' /_,/\,_\ '/.\' /_,/\,_\
  5. \/ _ _\/ _ ___ ___\/_ _ \/
  6. .\/. + | | | / \ | \| \| | | ' .\/.
  7. -=><=- | || ' || '_/| '_/\ / -=><=-
  8. '/\' |_|_||_|_||_| |_| |_| * '/\'
  9. __ /\ __ _ _ ___ _ _ ___ _ _ _ __ __ /\ __
  10. \_`\/`_/| | |/ \| | | || \ / \ | | |/ _/\_`\/`_/
  11. <_>()<_>| || | || |_ | || | || ' |\ /\_ \<_>()<_>
  12. /_,/\,_\|_|_|\___/|___||_||___/|_|_| |_| /__//_,/\,_\
  13. \/ _{}_ \/
  14. .\/. * .' '. + .\/.
  15. -=><=- ' + /_......_\ + -=><=-
  16. '/\' _ __ _ ."` `". * '/\'
  17. __ /\ __ | | ______ \ __ /\ __
  18. \_`\/`_/ |; |_.-'o o`-._/ \_`\/`_/
  19. <_>()<_> || | V | ' <_>()<_>
  20. /_,/\,_\ ||_ , |\ `'----'` / /_,/\,_\
  21. \/ '-.` .-';'---.--.--'; * \/
  22. .\/. * || | \ '. \ * .\/.
  23. -=><=- _||_ /'-.____\ `\ ; -=><=-
  24. '/\' / ) | | |`\ + '/\'
  25. __ /\ __ ' | _.' \ \ \ \ ' __ /\ __
  26. \_`\/`_/ \ || ()\ \\\ \ \_`\/`_/
  27. <_>()<_> \|| \\\\\\ \ | <_>()<_>
  28. /_,/\,_\ || () |_/ /_,/\,_\
  29. \/ * || ; * \/
  30. .\/. || () ' '. .\/.
  31. -=><=- ' .'|| '. -' '-. -=><=-
  32. '/\' .-' || `" " ` `--. '/\'
  33. __ /\ __jgs __ /\ __ __ /\ __ __ /\ __
  34. \_`\/`_/ .\'/. \_`\/`_/ .\'/. \_`\/`_/ .\'/. \_`\/`_/
  35. <_>()<_>-=>*<=-<_>()<_>-=>*<=-<_>()<_>-=>*<=-<_>()<_>
  36. /_,/\,_\ '/.\' /_,/\,_\ '/.\' /_,/\,_\ '/.\' /_,/\,_\
  37. \/ \/ \/ \/
  38.  
  39. https://twitter.com/LulzRo0ted
  40.  
  41.  
  42. HOHOHO merry xmas! To all you lulz anons you will find tons of candy, presents, but for you goverment, the best I can give you is coal! Welcome to LulzRooted Lulz X Mas 2013!
  43.  
  44.  
  45.  
  46. Idk what this shit means, but still it cam off of a government server, so it has to have some value!
  47. __
  48. .:::'-.
  49. /::: '.
  50. /::: \
  51. /::: \: |
  52. /::: |:: ;
  53. /::: \:: (
  54. /:::: ':.)'.
  55. .'```--'`'-.__.-" /. `\
  56. / ( ' ' '| (' |
  57. | ' . ) . '. ) /
  58. ) . ' . ' )_.'
  59. \ ;'--""-...-'-.__/ I am the Grinch who saved Xmas and stole
  60. '-/ , \ government Property
  61. ;_ )`-. .( \
  62. ."`` ` | `\ / | ;
  63. ; \ _| | _| '-.
  64. | '.(_/ \(_/ \
  65. | __ |
  66. ; `'.__.- (._.) ._. /
  67. \ \ ) | /`
  68. `'. '. ( / ;
  69. '. `'-'-._` _.' /
  70. `. '-' /
  71. |`-. _.'
  72. _| `. '--;`
  73. jgs_.-""` .`"=. .-._|
  74. / ' ) ` . `-""-.
  75. \ . ( ' . ( ' )
  76. `/-.__.--._ ' ._ ' .'
  77. /::::. `""`` `--`\
  78. /::::::. \
  79.  
  80.  
  81.  
  82. National Cemetery Administration - Local Reasonable Accommodation Coordinators
  83. Org. First Name Last Name Username Email Role Phone Number
  84. MSN1: Memorial Service Network I James Vogel james.vogel [email protected] LRAC 215-381-3787 x 4051
  85. MSN1: Memorial Service Network I Nicole Maldon maldon.nicole [email protected] Alt. LRAC 202-461-6227
  86. MSN2: Memorial Service Network 2 Mia Colemon mia.colemon [email protected] LRAC 404-929-5906
  87. MSN2: Memorial Service Network 2 Nicole Maldon maldon.nicole [email protected] Alt. LRAC 202-461-6227
  88. MSN3: Memorial Service Network 3 Albert Kuczak albert.kuczak [email protected] LRAC 303-914-5707
  89. MSN3: Memorial Service Network 3 Perdita Johnson-Abercrombie Johnson-Abercrombie, Perdita [email protected] Alt. LRAC 202-461-6743
  90. MSN4: Memorial Service Network 4 Mary Baker mary.baker [email protected] LRAC 317-916-3795
  91. MSN4: Memorial Service Network 4 Gretchen Ricketts gretchen.ricketts [email protected] Alt. LRAC 317-916-3790
  92. MSN5: Memorial Service Network 5 Angeline Scott angeline.scott [email protected] LRAC 510-637-6283
  93. MSN5: Memorial Service Network 5 Perdita Johnson-Abercrombie Perdita.Johnson-Abercrombie [email protected] Alt. LRAC 202-461-6743
  94.  
  95. .' , _\
  96. _ /_____\{_}
  97. / ( . {_______}
  98. | `|_ / . . \
  99. \_.'_} |. v .| I hate the federal government so this one is for you!
  100. {_.'| \ '...' /
  101. | \{`'.___.'`}
  102. \ /'._ _.'`\
  103. \ ; o ``` \
  104. ; o \ \_
  105. | o_ \.'` }
  106. ;==[_]======{__.'\
  107. \ |/) |
  108. `; .' /_/
  109. / `- / /
  110. / /\ \
  111. {`-._/ \ _.'`}
  112. ;-.__} {__.'\
  113. __/ / \_ \
  114. ( ` / / /
  115. '.__/ (__.'
  116. Negotiated Requirements Review.
  117.  
  118. 'Each negotiated requirement is presented using data from the multi-state negotiation of the Individual Requirement Review.
  119. The Idividual Requirement Review COMPARES the specific events or actions of two AHIC use cases to commonly identified requirements reported across all participating states.
  120. The following tables [T2] summarizes agreed minimum negotiated requirements and requirements placed in the parking lot for further discusion.
  121.  
  122.  
  123. "Negotiated Status: AUT 1 - User Authentication
  124. "" + "" means item is to be included in minimum policy;
  125.  
  126. "" P "" means Parking Lot - in need of further discussion."
  127. L- EHR Laboratory Use Case
  128. M - Medication Management Use Case
  129. Required-Optional Requirements* PARKING LOT
  130. T2. AUT1 Matched Requirements across use cases and reporting states L L/M L/M M L M M
  131. AUT 1 'User Authentication AZ CO CT OK MD NE WA ISSUES / EXPLANATIONS
  132. Negotiated Status
  133. Method of User Identity Vetting:
  134. + In person R R R R R R R In person to a trusted authority recognized by the State or Federal Government.
  135. - Notary O O O O
  136. + Demonstrate Government-issued ID R R R R R R R
  137. - Other:_______________
  138. + Validate Provider Licensure R O R R R R R Validate provider licensure when applicant is requesting an identity tied to a regulated provider type
  139. + Validate Employees of Licensed Provider Organization R R R R R R R
  140. + HIO use of a specific naming convention as a primary identifier R R/R R O O R R
  141. Assurance Level used:
  142. - Low (username/PIN) R [ R ] R
  143. + Medium (Knowledge/strong password) R R O R R R R
  144. Lab Results Context Restrictions: Need to send to HSPL collaborative - certain states have restrictions.
  145. - Ordering clinician R O R O
  146. - Associated organization R O R O
  147. Medication Context Restrictions: Need definition/clarifications on both context restrictions. Out of scope for this project.
  148. - Ordering clinician R O R R
  149. - Association with organization initiating order O O O R
  150. + Sensitivity Restricted: Where sensitivity restrictions apply, identity,role, affiliation and purpose of use must be declared and electronically codified.
  151. RIA HIV R O R R R O R
  152. RIA Mental Health Record R O R O R R
  153. RIA Substance Abuse Record R O R R R R
  154. RIA Sexual Health Record R O O O R R
  155. RIA Prison Health Record R O O
  156. RIA Other: __genetic information_____ R
  157. State reported as Not implementable at this time
  158. R- required; O - optional
  159.  
  160. "Negotiated Status: AUT2 - Subject of Care Identity
  161. "" + "" means item is to be include in policy;
  162.  
  163. "" P "" means Parking Lot - in need of further discussion."
  164. L- EHR Laboratory Use Case
  165. M - Medication Management Use Case
  166. Required-Optional Requirements*
  167. T2. 'AUT2 Matched Requirements across use cases and reporting states L L/M L/M M L M M
  168. AUT2- Subject of Care Identity AZ CO CT OK MD NE WA
  169. Negotiated Status
  170. + "Matching criteria policy
  171. (e.g., exact match on DOB, First Name, Last Name, Address)" R R R R R R R
  172. R- required; O - optional
  173.  
  174.  
  175. "Negotiated Status: AUT3 - System Authentication
  176. "" + "" means item is to be include in policy;
  177.  
  178. "" P "" means Parking Lot - in need of further discussion."
  179. L- EHR Laboratory Use Case
  180. M - Medication Management Use Case
  181. Required-Optional Requirements* PARKING LOT
  182. T2. AUT3 Matched Requirements across use cases and reporting states L L/M L/M M L M M
  183. AUT3 - System Authentication AZ CO CT OK MD NE WA ISSUES / EXPLANATIONS
  184. Negotiated Status
  185. System Identity Vetting: R Suggest changing "IN-PERSON SITE VISIT" to "data sharing agreement signed by legal and CEOs"
  186. + Assertion by Authorized Organization Representative R R/R R R R R R
  187. + Demonstrate association with Licensed Organization R R R R R O
  188. Assurance Levels:
  189. + High (PKI/Digital ID) R R R
  190. + Sensitivity Restricted O Where sensitivity restrictions apply, identity,role, affiliation and purpose of use must be declared and electronically codified.
  191. RIA HIV R /O O R R
  192. RIA Mental Health Record R /O R O R R
  193. RIA Substance Abuse Record R /O R R R R
  194. RIA Sexual Health Record R /O R O R R
  195. RIA Prison Health Record R /O O
  196. RIA Other: Specify:_________ R /O O
  197. R- required; O - optional
  198.  
  199.  
  200. "Negotiated Status:
  201. "" + "" means item is to be include in policy;
  202.  
  203. "" P "" means Parking Lot - in need of further discussion."
  204. L- EHR Laboratory Use Case
  205. M - Medication Management Use Case
  206. Required-Optional Requirements*
  207. Use case L L/M L/M M L M M
  208. T2. 'AUT4 Matched Requirements across use cases and reporting states AZ CO CT OK MD NE WA
  209. + Use of Timestamp R R R R R R R
  210. R- required; O - optional
  211.  
  212. "Negotiated Status:
  213. "" + "" means item is to be include in policy;
  214.  
  215. "" P "" means Parking Lot - in need of further discussion."
  216. L- EHR Laboratory Use Case
  217. M - Medication Management Use Case
  218. Required-Optional Requirements* PARKING LOT
  219. Use case L L/M L/M M L M M
  220. T2. AUT5 Matched Requirements across use cases and reporting states AZ CO CT OK MD NE WA ISSUES / EXPLANATIONS
  221. Organization Identity Vetting:
  222. + Personal Knowledge R R/O O R R R
  223. + Demonstrate Articles of Incorporation R/ /O R R R R
  224. + HIO use of a specific naming convention as a primary identifier R R Don't have right now. This is a requirement at the state level.Recommend development of a Naming Convention that can be registered and identified nationally.
  225. RIA Use of Object identifier (OID):______________ R O O
  226. RIA Describe:_idiosyncratic naming (Colorado)______ R O
  227. Assurance Levels: **
  228. + High (PKI/Digital ID) R R R R R
  229. - Lab Results Context Restrictions: Out of scope for this project.
  230. - Ordering system R/ O R R
  231. - Medication Context Restrictions: Out of scope for this project.
  232. - Ordering system O O R
  233. - Association with organization initiating order O O R
  234. + Sensitivity Restricted - Lab & Medication O R Where sensitivity restrictions apply, identity,role, affiliation and purpose of use must be declared and electronically codified.
  235. RIA HIV O R O R O O
  236. RIA Mental Health Record O R O R O
  237. RIA Substance Abuse Record O R R R O
  238. RIA Sexual Health Record O O O R
  239. RIA Prison Health Record O O O
  240. R- required; O - optional
  241.  
  242. "Negotiated Status:
  243. "" + "" means item is to be include in policy;
  244. "" P "" means Parking Lot - in need of further discussion."
  245. L- EHR Laboratory Use Case
  246. M - Medication Management Use Case
  247. Required-Optional Requirements* PARKING LOT
  248. Use case L L/M L/M M L M M
  249. T2. AUT6 Matched Requirements across use cases and reporting states AZ CO CT OK MD NE WA ISSUES / EXPLANATIONS
  250. + Means for identifying recipients of communications: ** Need further clarification. Also not sure which use case it applies to.Need to have an identity established, but the identification method can include but not be restricted to one of the following methods:
  251. + Derived from ordering system communications R O R R
  252. + Selected from provider directory O R O
  253. + Derived from identifiers included in request for information /R O R R R
  254. R- required; O - optional
  255.  
  256.  
  257.  
  258. "Negotiated Status:
  259. "" + "" means item is to be include in policy;
  260.  
  261. "" P "" means Parking Lot - in need of further discussion."
  262. L- EHR Laboratory Use Case
  263. M - Medication Management Use Case
  264. Required-Optional Requirements*
  265. AUT7 Included in Med Man. Use Case only. L M M M L M M
  266. T2. AUT7 Matched Requirements across use cases and reporting states AZ CO CT OK MD NE WA
  267. + Signer credentials: R
  268. + Credential issued by trusted authority R R R R
  269. + Credential is current R R R R
  270. + Credential is not suspended/revoked R R R R
  271. + Credential is of appropriate type (e.g. physician, pharmacist) R R R R
  272. + Data Integrity: R
  273. + Data has not been changed since signature R R R
  274. + Timestamp R R R
  275. R- required; O - optional
  276.  
  277.  
  278.  
  279. Applicable ISO 17799 Standard(s) & References HIPAA Citation Standard Implementation Specification Implementation Requirement Description
  280. SECURITY STANDARDS: GENERAL RULES
  281. ADMINISTRATIVE SAFEGUARDS
  282. 6.1.2, 6.1.4 164.308(a)(3)(ii)(B) Workforce Clearance Procedure Addressable Procedures to ensure appropriate PHI access
  283. 6.1.2, 6.1.4 164.308(a)(3)(ii)(C) Termination Procedures Addressable Procedures to terminate PHI access
  284. 9.6.1, 9.5.3, 9.2.2, 10.4.3 164.308(a)(4)(i) Information Access Management P&P to authorize access to PHI
  285. 4.2.1 164.308(a)(4)(ii)(A) Isolation Health Clearinghouse Functions Required P&P to separate PHI from other operations
  286. 9.1.1, 9.2.2, 9.4.1, 9.6.2, 9.2.1, 8.1.4, 5.2.1 164.308(a)(4)(ii)(B) Access Authorization P&P to authorize access to PHI
  287. 8.1.4, 9.1.1, 9.2.2, 9.2.4, 9.4.1, 9.5.2, 9.5.3, 9.6.2, 8.6.4, 5.2.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 12.1.5 164.308(a)(4)(ii)(C) Access Establishment and Modification Addressable P&P to grant access to PHI
  288. 6.2.1, 8.7.7, 9.2.1, 9.2.2, 9.3.2, 9.8.1, 8.7.7, 8.7.4, 12.1.5, 6.1.1, 6.1.3 164.308(a)(5)(i) Security Awareness Training Training program for workers and managers
  289. 6.2.1, 9.3.2, 6.1.1, 6.1.3 164.308(a)(5)(ii)(A) Security Reminders Addressable Distribute periodic security updates
  290. 8.3.1, 8.7.4, 4.1.4, 10.4.1, 10.4.2, 10.5.1-10.5.5 164.308(a)(5)(ii)(B) Protection from Malicious Software Addressable Procedures to guard against malicious software
  291. 8.4.2, 9.7.1, 9.7.2, 8.4.3 164.308(a)(5)(ii)(C) Log-in Monitoring Addressable Procedures and monitoring of log-in attempts
  292. 9.2.3, 9.3.1, 9.5.4 164.308(a)(5)(ii)(D) Password Management Addressable Procedures for password management
  293. 8.1.3, 4.1.6 164.308(a)(6)(i) Security Incident Procedures P&P to manage security incidents
  294. 6.3.1,6.3.2,6.3.4,8.1.3 164.308(a)(6)(ii) Response and Reporting Required Mitigate and document security incidents
  295. 11.1.1, 8.6.3, 4.1.6, 8.1.2 164.308(a)(7)(i) Contingency Plan Emergency response P&P
  296. 8.1.1, 8.4.1, 11.1.3, 11.1.2, 8.6.3 164.308(a)(7)(ii)(A) Data Backup Plan Required Data backup planning & procedures
  297. 11.1.3 164.308(a)(7)(ii)(B) Disaster Recovery Plan Required Data recovery planning & procedures
  298. 11.1.3 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Required Business continuity procedures
  299. 7.2.2, 11.1.3, 11.1.5, 8.1.5, 7.2.3, 10.5.1-10.5.5 164.308(a)(7)(ii)(D) Testing and Revision Procedures Addressable Contingency planning periodic testing procedures
  300. 11.1.2, 11.1.4, 8.1.5, 5.2.2, 8.1.2 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Addressable Prioritize data and system criticality for contingency planning
  301. 4.1.5, 9.7.2, 12.2.1, 12.2.2, 3.1.2, 6.3.4, 8.1.1, 8.2.2 164.308(a)(8) Evaluation Periodic security evaluation
  302. 4.2.1, 4.2.2, 4.3.1, 8.1.6, 12.1.1, 4.1.6, 8.2.1, 8.7.4 164.308(b)(1) Business Associate Contracts and Other Arrangements CE implement BACs to ensure safeguards
  303. 8.71,4.3.1,12.1.1 164.308(b)(4) Written Contract Required Implement compliant BACs
  304. PHYSICAL SAFEGUARDS
  305. 7.1.1-7.1.5, 12.1.3, 9.3.2 164.310 (a)(1) Facility Access Controls P&P to limit access to systems and facilities
  306. 7.2.2, 11.1.1, 11.1.3, 12.1.3, 4.1.7, 7.2.3, 7.2.4, 8.1.1 164.310(a)(2)(i) Contingency Operations Addressable Procedures to support emergency operations and recovery
  307. 7.1.1, 7.1.3 164.310(a)(2)(ii) Facility Security Plan Addressable P&P to safeguard equipment and facilities
  308. 7.1.2, 7.1.4, 9.1.1 164.310(a)(2)(iii) Access Control Validation Procedures Addressable Facility access procedures for personnel
  309. 7.2.4, 12.1.3 164.310(a)(2)(iv) Maintenance Records Addressable P&P to document security-related repairs and modifications
  310. 2.2.4, 7.2.1, 8.6.1, 7.1.4, 7.2.4, 8.6.1, 12.1.5, 9.3.2, 8.1.5, 4.1.4, 5.2.1 164.310(b) Workstation Use P&P to specify workstation environment & use
  311. 7.2.1, 7.2.4, 8.6.2, 9.3.2, 7.3.2 164.310(c) Workstation Security Physical safeguards for workstation access
  312. 5.1.1, 7.2.5, 7.3.2, 8.7.2, 8.6.7, 9.8.1, 8.5.1, 6.3.3 164.310(d)(1) Device and Media Controls P&P to govern receipt and removal of hardware and media
  313. 7.2.6, 8.6.2 164.310(d)(2)(i) Disposal Required P&P to manage media and equipment disposal
  314. 7.2.6, 8.6.2 164.310(d)(2)(ii) Media Re-use Required P&P to remove PHI from media and equipment
  315. 5.1.1, 7.3.2, 7.2.5, 8.7.2, 9.8.1 164.310(d)(2)(iii) Accountability Addressable Document hardware and media movement
  316. 8.1.1, 8.4.1, 8.6.3, 12.1.3 164.310(d)(2)(iv) Data Backup and Storage Addressable Backup PHI before moving equipment
  317. TECHNICAL SAFEGUARDS
  318. 9.1.1, 9.4.1, 9.6.1, 12.1.3 164.312(a)(1) Access Control Technical (administrative) P&P to manage PHI access
  319. 9.2.1, 9.2.2 164.312(a)(2)(i) Unique User Identification Required Assign unique IDs to support tracking
  320. 11.1.3 164.312(a)(2)(ii) Emergency Access Procedure Required Procedures to support emergency access
  321. 9.5.7, 9.5.8, 7.3.1 164.312(a)(2)(iii) Automatic Logoff Addressable Session termination mechanisms
  322. 8.5.1, 8.7.4, 10.3.1, 10.3.2, 10.3.3, 12.1.6 164.312(a)(2)(iv) Encryption and Decryption Addressable Mechanism for encryption of stored PHI
  323. 8.1.3, 8.6.2, 9.7.1, 9.7.2, 12.3.1, 12.3.2, 10.3.4, 9.7.3, 4.1.6, 4.1.7 164.312(b) Audit Controls Procedures and mechanisms for monitoring system activity
  324. 12.1.3, 10.2.1, 10.4.2 164.312(c)(1) Integrity P&P to safeguard PHI unauthorized alteration
  325. 10.2.3, 8.1.6 164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Addressable Mechanisms to corroborate PHI not altered
  326. 9.4.3, 9.5.3, 8.76, 4.2.1, 9.2.1, 9.2.2, 10.2.1, 10.3.3 164.312(d) Person or Entity Authentication Procedures to verify identities
  327. 10.3.1, 10.3.4, 10.2.4, 4.2.1 164.312(e)(1) Transmission Security Measures to guard against unauthorized access to transmitted PHI
  328. 12.1.3, 10.3.4, 8.7.4, 7.2.3, 8.7.6, 9.4.3, 9.4.3-9.4.9, 9.6.2,10.2.2, 10.2.4, 10.4.3 164.312(e)(2)(i) Integrity Controls Addressable Measures to ensure integrity of PHI on transmission
  329. 8.5.1, 8.7.4, 10.3.1, 10.3.2, 10.3.3, 10.4.2, 12.1.6 164.312(e)(2)(ii) Encryption Addressable Mechanism for encryption of transmitted PHI
  330. ORGANIZATIONAL REQUIREMENTS
  331. 4.2.2, 4.3.1, 8.1.6, 12.1.1, 4.2.1, 8.2.1, 4.1.6 164.314(a)(1) Business Associate Contracts or Other Arrangements CE must ensure BA safeguards PHI
  332. 4.2.2, 4.3.1, 8.1.6, 8.7.1, 12.1.1, 8.7.4 164.314(a)(2) Business Associate Contracts BACs must contain security language
  333. N/A 164.314(b)(1) Requirements for Group Health Plans Plan documents must reflect security safeguards
  334. N/A 164.314(b)(2)(i) Implement Safeguards Plan sponsor to implement safeguards as appropriate
  335. N/A 164.314(b)(2)(ii) Ensure Adequate Separation Security measures to separate PHI from plan sponsor and plan
  336. N/A 164.314(b)(2)(iii) Ensure Agents Safeguard Ensure subcontractors safeguard PHI
  337. N/A 164.314(b)(2)(iv) Report Security Incidents Plan sponsors report breaches to health plan
  338. 3.1.1, 8.1.1, 12.1.4 (Privacy 6.1.3, 7.3.1, 8.7.4, 8.7.7), 12.1.1, 9.8.2, 12.1.2, 12.2.1, 12.1.4 164.316(a) Policies and Procedures P&P to ensure safeguards to PHI
  339. 8.1.1, 12.1.1, 12.2.1 164.316(b)(1) Documentation Document P&P and actions & activities
  340. 164.316(b)(2)(i) Time Limit Retain documentation for 6 years
  341. 164.316(b)(2)(ii) Availability Documentation available to system administrators
  342. 4.1.7, 12.1.1 164.316(b)(2)(iii) Updates Periodic review and updates to changing needs
  343.  
  344.  
  345. .------,
  346. .\/. |______|
  347. _\_}{_/_ _|_Ll___|_
  348. / }{ \ [__________] .\/.
  349. '/\' / \ _\_\/_/_
  350. () o o () / /\ \
  351. \ ~~~ . / '/\'
  352. _\/ \ '...' / \/_
  353. \\ {`------'} //
  354. \\ /`---/',`\\ //
  355. \/' o | |\ \`//
  356. /' | | \/ /\
  357. __,. -- ~~ ~| o `\| |~ ~~ -- . __
  358. | |
  359. jgs \ o /
  360. `._ _.'
  361. ^~- . - ~^
  362.  
  363.  
  364. IT Product Name Policy Path Policy Setting Name FDCC Windows XP Final FDCC Windows Vista Final Windows 7 USGCB Windows 7 DOD Windows 7 SSLF
  365. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Account lockout duration 15 minutes 15 minutes 15 minutes 0 minutes 15 minutes
  366. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Account lockout threshold 5 invalid logon attempts 5 invalid logon attempts 5 invalid logon attempts 3 invalid logon attempts 10 invalid logon attempt(s)
  367. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Reset lockout counter after 15 minutes 15 minutes 15 minutes 60 minutes 15 minutes
  368. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy Enforce user logon restrictions Not Defined Not Defined
  369. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy Maximum lifetime for service ticket Not Defined Not Defined
  370. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy Maximum lifetime for user ticket Not Defined Not Defined
  371. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy Maximum lifetime for user ticket renewal Not Defined Not Defined
  372. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy Maximum tolerance for computer clock synchronization Not Defined Not Defined
  373. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Enforce password history 24 passwords remembered 24 passwords remembered 24 passwords remembered 24 passwords remembered 24 passwords remembered
  374. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Maximum password age 60 days 60 days 60 days 60 days 90 days
  375. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Minimum password age 1 day 1 day 1 day 1 day 1 day
  376. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Minimum password length 12 characters 12 characters 12 characters 14 characters 12 characters
  377. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Password must meet complexity requirement Enabled Enabled Enabled Enabled Enabled
  378. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy Store passwords using reversible encryption Disabled Disabled Disabled Disabled Disabled
  379. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Maximum application log size 16384 kilobytes Not Defined
  380. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Maximum security log size 81920 kilobytes Not Defined
  381. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Maximum system log size 16384 kilobytes Not Defined
  382. Windows Vista Computer Configuration\Windows Settings\Security Settings\Event Log Prevent local guests group from accessing application log (Not Applicable) Not Defined
  383. Windows Vista Computer Configuration\Windows Settings\Security Settings\Event Log Prevent local guests group from accessing security log (Not Applicable) Not Defined
  384. Windows Vista Computer Configuration\Windows Settings\Security Settings\Event Log Prevent local guests group from accessing system log (Not Applicable) Not Defined
  385. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retain application log Not Defined Not Defined
  386. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retain security log Not Defined Not Defined
  387. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retain system log Not Defined Not Defined
  388. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retention method for application log Not defined Not Defined
  389. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retention method for security log Not defined Not Defined
  390. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Event Log Retention method for system log Not defined Not Defined
  391. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\rcp.exe "Administators: Full
  392. System: Full" Not Defined
  393. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\reg.exe "Administators: Full
  394. System: Full" Not Defined
  395. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\regedt32.exe "Administators: Full
  396. System: Full" Not Defined
  397. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\regedit.exe "Administators: Full
  398. System: Full" Not Defined
  399. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\arp.exe "Administators: Full
  400. System: Full" Not Defined
  401. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\at.exe "Administators: Full
  402. System: Full" Not Defined
  403. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\attrib.exe "Administators: Full
  404. System: Full" Not Defined
  405. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\cacls.exe "Administators: Full
  406. System: Full" Not Defined
  407. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\debug.exe "Administators: Full
  408. System: Full" Not Defined
  409. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\edlin.exe "Administators: Full
  410. System: Full" Not Defined
  411. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\eventcreate.exe "Administators: Full
  412. System: Full" Not Defined
  413. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\eventtriggers.exe "Administators: Full
  414. System: Full" Not Defined
  415. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\mshta.exe "Administators: Full
  416. System: Full
  417. Users: Read and Execute" Not Defined
  418. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\net.exe "Administators: Full
  419. System: Full" Not Defined
  420. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\net1.exe "Administators: Full
  421. System: Full" Not Defined
  422. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\netsh.exe "Administators: Full
  423. System: Full" Not Defined
  424. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\regini.exe "Administators: Full
  425. System: Full" Not Defined
  426. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\regsvr32.exe "Administators: Full
  427. System: Full" Not Defined
  428. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\rexec.exe "Administators: Full
  429. System: Full" Not Defined
  430. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\route.exe "Administators: Full
  431. System: Full" Not Defined
  432. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\rsh.exe "Administators: Full
  433. System: Full" Not Defined
  434. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\sc.exe "Administators: Full
  435. System: Full" Not Defined
  436. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\secedit.exe "Administators: Full
  437. System: Full" Not Defined
  438. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\subst.exe "Administators: Full
  439. System: Full" Not Defined
  440. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\System32\systeminfo.exe "Administators: Full
  441. System: Full" Not Defined
  442. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\tftp.exe "Administators: Full
  443. System: Full" Not Defined
  444. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\File System %SystemRoot%\system32\tlntsvr.exe "Administators: Full
  445. System: Full" Not Defined
  446. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit account logon events Success, Failure Not Defined
  447. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit account management Success, Failure Not Defined
  448. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit directory service access Failure Not Defined
  449. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit logon events Success, Failure Not Defined
  450. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit object access Failure Not Defined
  451. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit policy change Success Not Defined
  452. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit privilege use Failure Not Defined
  453. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit process tracking No auditing Not Defined
  454. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy Audit system events Success Not Defined
  455. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Accounts: Administrator account status Enabled Disabled Disabled Disabled Disabled
  456. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Accounts: Guest account status Disabled Disabled Disabled Disabled Disabled
  457. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Accounts: Limit local account use of blank passwords to console logon only Enabled Enabled Enabled Enabled Enabled
  458. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Accounts: Rename administrator account Renamed_Admin Renamed_Admin Renamed_Admin ORGANIZATIONAL DEFINED NAME Recommended
  459. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Accounts: Rename guest account Renamed_Guest Renamed_Guest Renamed_Guest ORGANIZATIONAL DEFINED NAME Recommended
  460. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Audit: Audit the accesss of global system objects Disabled Disabled Disabled Disabled Disabled
  461. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Audit: Audit the use of Backup and Restore privilege Disabled Disabled Disabled Disabled Disabled
  462. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings (Not Applicable) Enabled Enabled Enabled Enabled
  463. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Audit: Shut down system immediately if unable to log security audits Disabled Disabled Disabled Disabled
  464. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax Not defined Not Defined Not Defined
  465. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax Not Defined Not Defined Not Defined
  466. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Allow undock without having to log on Not Defined Not Defined Not Defined
  467. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Allowed to format and eject removable media Administrators and Interactive Users Administrators and Interactive Users Not Defined Administrators Administrators
  468. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Prevent users from installing printer drivers Disabled Disabled Disabled Enabled Enabled
  469. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Restrict CD-ROM access to locally logged-on user only Disabled Disabled Disabled Disabled Disabled
  470. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Restrict floppy access to locally logged-on user only Disabled Disabled Disabled Disabled Disabled
  471. Windows XP Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Devices: Unsigned driver installation behavior Do not allow installation (Not Applicable)
  472. Windows XP Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain controller: Allow server operators to schedule tasks Not Defined (Not Applicable)
  473. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain controller: LDAP server signing requirements Not Defined Not Defined
  474. Windows XP and Vista Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain controller: Refuse machine account password changes Not Defined Not Defined
  475. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Digitally encrypt or sign secure channel data (always) Enabled Enabled Enabled Enabled Enabled
  476. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Digitally encrypt secure channel data (when possible) Enabled Enabled Enabled Enabled Enabled
  477. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Digitally sign secure channel data (when possible) Enabled Enabled Enabled Enabled Enabled
  478. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Disable machine account password changes Disabled Disabled Disabled Disabled Disabled
  479. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Maximum machine account password age 30 Days 30 Days 30 Days 30 Days 30 Days
  480. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Domain member: Require strong (Windows 2000 or later) session key Enabled Enabled Enabled Enabled Enabled
  481. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Do not display last user name Enabled Enabled Enabled Enabled Enabled
  482. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Do not require CTRL+ALT+DELETE Disabled Disabled Disabled Disabled Disabled
  483. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Message text for users attempting to logon This system is for the use of authorized users only. Individuals using this computer system without authority or in excess of their authority are subject to having all their activities on this system monitored and recorded by system personnel. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity system personal may provide the evidence of such monitoring to law enforcement officials. This system is for the use of authorized users only. Individuals using this computer system without authority or in excess of their authority are subject to having all their activities on this system monitored and recorded by system personnel. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity system personal may provide the evidence of such monitoring to law enforcement officials. This system is for the use of authorized users only. Individuals using this computer system without authority or in excess of their authority are subject to having all their activities on this system monitored and recorded by system personnel. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity system personal may provide the evidence of such monitoring to law enforcement officials. DoD Banner Not Defined
  484. Windows XP, Vista, and 7 Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options Interactive logon: Message title for users attempting to logon -- WARNING --
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!