Sample Security Assessment Reporting Form (Page 2 of 3) in pdf

Sample Security Assessment Reporting Form Page 2

Attachment II

Sample Security Assessment Reporting Form

To help organizations collect, organize, and report the findings of individual security control

assessments for the information system, a sample reporting form is provided below. This sample

reporting form is illustrative and is intended to be used for each security control and control

enhancement included in the security control assessment. The form is not intended to limit the

flexibility of organizations in determining the most appropriate presentation of assessment

findings for the purposes of a given security control assessment.

SAMPLE SECURITY ASSESSMENT REPORTING FORM

SECTION I

INFORMATION SYSTEM AND ASSESSMENT INFORMATION

Information System Name

Impact Level

Low, Moderate, High

Site(s) Assessed

Assessment Date(s)

Information System Components Where Security Control Employed (e.g., firewall, router, workstation, server, laptop,

PDA)

SECTION II

SECURITY CONTROL INFORMATION

Security Control or Control Enhancement

Insert text from security control or control enhancement being assessed as stated in, or as referenced by the approved

system security plan.

Supplemental Guidance Associated with Security Control or Control Enhancement

Insert text from the supplemental guidance from the security control or control enhancement being assessed as stated in, or

as referenced by the approved system security plan.

SECTION III

ASSESSMENT FINDINGS

Assessment Objective

Identify assessment objective (e.g., CP-1.1, associated with the security control or control enhancement described above).

Determination Statements

Finding

See determination statements below which restate the determinations from the assessment

(S/O)

objective, as tailored for this security control assessment (e.g., including organization-specific

information, where appropriate).

Determination Statement

- 2 -

Sample Security Assessment Reporting Form Page 2