ࡱ>  9:;<=x  !#$%&'()*+,-./012345678?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Root Entry F:>Workbook ӡMBD0004FE02  F&7&7Ole = !-F!cover!Object 1  F'Microsoft Office Word 97-2003 Document MSWordDocWord.Document.89qOh+'0  4 @ L Xdlt|Christian, Michele  Normal.dotmChristian, Michele Data 81Table",CompObjyOlePres000>\8DdO zp<  C Ab48{ߌ[4yͰL8Dn8{ߌ[4yͰLPNG  IHDRO:EgAMA pHYs12N– IDATx}8e}{p#0rCG`9&r"D3KPxg`EF.oϼX̋ϼX̋ϼX̋ϼX̋ϼX̋ϼX̋0+놡y8ck+Sx脰:D[Q/[??HPTI5o HuoD1ճC ]^Qhz|`VOOay Z8n#ʬCR6RJUoZ篟tXܳCPZNa~FET5ېbns#n[.ZW>w9 |[FV,:xۧ/{k>qvD h"СP))F #ƟS)!GĎjJ3+Dbm5Ĕn~CZLCa#`m魜;?kWOV!Jm UKaܣj\$܄=O9FV"kTגyn- jVw!:j<ݜwAxND(ySzYKz>pRN=XT*QU/{o+T&iJ6YK~=H'?0Ou7-峭+5GdA:Vc&~E|OJӒ*X@UNHtc>Z󋄆4OgҨz/'~BQ1| .3SZ$N588l ՃbjU4&٢x/1fç#N-olKu!,O[\g(yϨh:\4{5q=~)|*Xpu0zc7C6Jg5}9AFtFqr74՚ d4ϣnVH A? 'bq„c|sB&IPݝ6m}궕i#:'PfC.4NUc31Zoj!4Oqf3]o"eLt W<'aM(>e5v M:_Y*y]Ɓ ďg%u =ԖIWqBYm]Gn 4<rф 傼;+ZܞQ |V^kɶ=KL)9#bчMBHdG tSs 6( W<ϖO3qͧTʴ[K` k߂cd ؑ/\^芊 >1_OO, λX%Z뤿6@qNgϗI3<=Α}M:skfwvA[" %cŖ=yTwt|P @Y9[jO==E /`1{zX Uѫc5qVxͤe+WbJkAmؗHv&5vmԜ0?0`OwjtkᾛMX;>_*I|p۫7QǢr&C"[m%Ls h6>%k^n{;8c,z'F3{?ͲQ{@?YM|R5\טT}dufx ]"H!' C~H)ӘDVi})"OҼFZL0+IO1&f>}OXwMZѺJnrtw2@v&O7>z?l3bS]';q:MyT'fEmS ű+HZOn,Fa `D7·(-$T*&󟟢ܣX^$Q;_MuKé(Uֆ1uCs1XGb6(kg3h١Rq"3n논%SRbKO,Ts~f~90C`QɨĬlYkTsL,'˼k N ۽ [rLc(>-ZA )ҟFJAt~O[~O)gA{'maQ aB3r#Sq#rО5$Pb=6 ՅZvѺEfD+1EѾDT $wV{cDyhK֚&{)t }5 EyTV\vj.AsTr ;21Vm|hY%!#n>q^: nI {N4}&8Zܚ6HȖ܊)*# zc۶7o= 1z E@l>}= ׌7EBe¦cБ~P {9dkwe5-|dBͫ7EQm]eU0kl\% ~߳zlLrGݠ5fq~Ê Mb஁՚;vpl_3N( a5LfH>&Qb0'=fbLO&߃uY+XPEDJW]3LLL UJ oYs_M'6($>LYcR31[mU %G9L'0.Xָ*vKZ߫Z?NFD>}2 >wV _U 7Q <\YhNh1U=H' x?BkS|blyjrrDTP,8pCwqm?dο"B_WeP]ڀk{e'bf0ݑ]'إ)ԮZg:ħ0nY-ˍ :*1稝 RjVWAN$(VT@W&iP?|opOj=@Z=Nx>;&=VSj'4 &*NwCvό5\4c=:_8~T`w Ci??ҍ}mkP3ZGuxkТ-q K@ $Gۖ [ѐZJدqЀau|'eM_͉v*l' xZ3NX:D2m΂-Dzwk1@t_xUڏ|G-U~lLKوĞڱeJ? /v|v܈k,'|`Lqu`a0QT'{KE!S$,kض'8NՀ88dRdy:7pbmd?uPs7a,zh4@2,|u m16j=yסhg9Ms5'.)lp*,Gxst% UgBu 3ggwhxy׃$Ӏ._)$/]uQI͟ἧ&O:@9T'>t~m 4~@sTodZ揥&"_ [$)(zuOoyqS]n?ħyx++W"%EUO{/`,P'^qbN -=8R/]uF<'PkViHguDvTq=4~9 E[:=S{uCrN2o3CU%^MtKs^çyG-VK26۲uYwg3ЀRuJnى| +ZL'm)D9,,ϧw։MɓnS.!#1N)rt#|nDX~ұDx:} hG"8DD5׀AOI` C*T ^NԢ#qoWD^Km^NJϩ 4FŖBӳ٦hz4y.4yҝ4dIB,^N,il xs EbD CFLE[% aQNƏ*żgQ% *k<s&Tq~)qgK#X nX|L )4tsl(%9y3ڏ|ڑhzKn%g|S&)\>נo@3([W`ЎD_$ WQ`-Ml[C *\Dn ^0Cxj}A-.O5Af7JhtY?`Z|?}H$=E[]g?N><$*hnY !*2S>||Ͼ"ey?\ꋆCXAE)qO_EP=)N r ڱWoK]>,g䓿rwo?ۏU\2!QAp4._~0HhSBY2@"XbjZãuE+N;{b7Oy ۥ1{i3;irMCPq?wf|`*gBQ mGCvEǡ2CD:Sqxtd?r/J,P'O0[߻la<о@cH'i0o1h篟~ 7c=KY}H9PQq| ? /ЮwTdml&=ʒè ,3 Yf*s}73lǜJ<[y|OOm:*KD؃0 >g/CMrwDESt,|&sonu!]{yCDP`;4}toS^OwG/1Յ3٧*N.@~Hnl|mI}E5I 3$LNW`UXBowN?vNLDw|.ݪ8J:*Vn_1 a7 ?A)wk*B6sX.tpיhbЏADgO[Q?{l5LQ<76ٍ$UolFLs )9i"p ]msPw'6/l6j;Bňj kƶhԽ3 X}RWv]Nat;΅bPWU9s5z8%w_DDGݓD:Jܡr̷Đ}`Dh._G.E>IF.b=b#>Cͥ'1]sWO?9:L $(qTO97h*h0SJAV\:Dh=ΰk^ZK4N4SoNNZX>! []'*R힓]0*OPqy{K/IT[g ."Onn|ul}^-a"4byrab/<^)Pt7nF`e"Rص d5t[2~DNlRӇ˥a>SAۿK#sU?=x7ǽ ḀG~uZ.w鞖1EL\/\f<Ѯ04ԺzzOgٮ1i{u^,WF]\85PEB9bYiӶ5l]a~Im9e%dDŽ!`bKewKtRoO+VO2.e OO?|e|Sx|$+cֹB}ҙS=Rx#Xc%K|B{C 7cԟ}@TX@bn"ˋZvQe(b^œi[}nKA,8R⪞GKj#Lz67 fPS=C# vQ7+wB&o\~l좢E} ٠Ds`/'ב4Qr)qik )e-1B\ϯǓ2|cx{%F9!s9Y¥r1<)\[NS΂ߏkat~\D/#.0mbp<((v`hĊ/]㾼fUxL,۹h-Dq|.&\ARfj\lzxbՉWxY>vH5+ a.2_~kF &_'4 <螦oUlFwIEEяⰫ3އ"x !I[= ߸N|gdd9s& McbTrC13u)\qy)`f/2&A-0Kt O%wV3>>"s":Y#ɟ~t N)3*#5Vi ĶޘUx煱;Ձpn_³mw<*҆SxyfM:O' .mj r>ҋ"n*NT4pN c \)1 {on^ WXdrqޑy0]{tVgź? *xntlo:p;Fݱ&-WJ]0\OXg>.)8u;":y۱=ǐ淖}/ѳ"p+e:&s&gNg<8fe[M蚧}xV8q$,;<?wvG8$g}-y;,*=Qxu`w*ޟ쿽p:^cWqxd]YbPT怚wRfE"za0Z1јa4U{IMхBI*PEq,.bPlvLMZzm;Q|FJL#qL wbKzo6\#|3g/FcF3VUxd1dy #UB|q|F,~`C5>fG11]˞#y=~hauucX!-q|ڻ >=':B~[h*NV|=Mɧ92Y (E* vfx %ߵ $+lgoaBgڍ18M@Ty-q =k ;p1N/JPIeUKrk /PPG" XE7@ ?)8֋(|& <]_EmE#æV\lވbSM/2( d|izy8 yeo'+-kF3X@iK;-^(۽#m6yܔO"7?T,G/QdōLꚃlcL˰ |F3P6"|>Zё.(#§1Ѫ)ħ1Ƿɵوth1ُ)ɱ?<>JA<+ ?t/d CWOC#+y+y+y+y+y+y+y+y+y+y+y+y+yWQ~?|q^R2j^%"Eh嘫g^|g^|g^|g^|g^|g>$pxW.>w@YoJѝSqzx:tn4W%sW䡽F1kymЉO2g?Y3:̤&bstU] |b`,Vl k& W(|2\i|\}1ɸK^9(vS>B |9 >7ç6NcBB"|Xgx>8.45ǧp| [Qj{cюefu ;)X&~Jȧ5'| Ơ#2C AT.gӷtⳋsN pCvm>x~l bj; T^x[T?\MԭӦ̾1=qYP)<< еl=P<a x; ӼO(I}@޹? c%T.% 缟pk%c藹}gy/^%+y+y+y+y+y+y+y+y~a/9\~+Gݝ?eY׷[b9Plz}qUyڿeƵѷ]b6 q'9ϏC! ryAo,㣇[xw"xse e; <qxψ> (U)s Otnx B=/bIrvtllO(L@G q)cڹ 5*>U洡P}ጟ欙S7e;¿?O(戾vİjہ񁣧95?ϰҾǑ>ֲ%p?DֱЯ|.1E!=~A 8nag(33}8^\QRs ]0v1Cٜ&ǁxS32{GTGܘ98\*>E@8;BJ`aIF|윟|wԗBg>k1#!CNRh}a'Q}ȪQսbNg~iRQ4Es>/l?xjc1G^2Qsɱ&O'x2E祊tTЊlOT` T,Ŷ%LF2ٲLML\zjhb zyJ,|" Bj9swF|w0oJs\HTTÁ~k-ՎHL>!?yY+$)Y:zoD V_>|c+@283c\R1o 9f+< l?vJ=Y-a42v$r1v#|Εs;Ͻw\n; oR|МL 2p\_)`l8[0DǜJ>-l*ĩ릿o2KVڶmaI_4 }{0 |Zk<|{@6y07MNу՘;6`1|.|B;D:9*Őz ^"L=F#Pv ˻5} O#?tg4 $|x p{y,eԍ&.,kMi뺞/5oHyvZu#ԣ1[Ɛ9oOLE+ޜ p0OBěRyvh ٵ_r*6'\'쌹'MeQ0OVog=U(T1izg墈4+ܴiE(n[9ZAZ|idE_UQ dԇp C)us iC.*9Kt|2n Ԏ^?7cP ͐ + uL ZIl/ٿD{% ȜTeN|}NIka l?L';y$*||FeuP-;v;{Rwfoyy`[? wzPGDw)A_o$Er>s´"0<< U۾A5?'~@ѿ?) e痺:P8;_(IPLm9-/9">^wɩmf:iCe=>BHg6a!*2GJ`B)sᳱcli/soȑͧʣؚ l)?m f#TL=scb>[=lCc[~>LafOTA?Uk3wNa1kf=2l˃( d>_jSb Pħ_myݧ>Kh.#*MNPħC{꽏GE/!O^në  6ё-u/ G'YŻ'|1ERYU؟xL"&i1ULdiqqY`t陓4>#v5A>ɠR|2lOv,ϲp@?HVr&2Hj-//ozĩϕ=Uy[g# E%,~o8+U;N.|ڽa?oϼk=983Ec"ZO#f{DHJY&RO;u0XB/v6v09ASigz{$s |q3HH`oӼf>sHeWdB߷SqTZ~O7xkhvuB)E(Z}UaRw}~؃W\5Ƙ 8;[w"GɊ_M_1`Fxw[7+}Θ1'սi GHSʍ{`;EČ/O8G fJt#A~y$ݏPp~t4y GzDϴπ06666666666666666666666666666666666666666666666666hH6666666666666666666666666666666666666666666666666666666666666666662 0@P`p2( 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p8XV~_HmH nH sH tH N`N Normal,ndhCJOJQJ_HmH sH tH " pHeading 1,1 ghost,g,Ghost,ghost,g ,1ghost,Ghost +,h1,Chapter Number,Divider Page Text,og,Heading,Ghos,g1,Graphic @&CJ*2* Heading 2,2 headline,h,headline,h2,h headline,Heading 11,heading 1,H2,heading 2,Heading 12,oh,Header1,Heading 121,h g2,Heading 1211,Heading 12111,2 hheadline,01 Headline,Heading 13,Heading 121111,Heading 1211111,Heading 12111111,2 headline1,2 headline2@& #@5;020 Heading 3,3 bullet,b,2,bullet,SECOND,Bullet,Second,4 bullet,h3,BLANK2,B1,b1,blank1,3 dbullet,ob,bbullet,3 gbullet,dot,second,3bullet,Bulle,bdullet,heading 3,Bullet 1,3 dd,3 cb,3 Ggbullet,02 Bullet,bul,B,Heading 21,3 bbullet,Heading 211,3 bulle,h 2,Dot#F@&]#^F``B` Heading 4,4 dash,d,38[@&]8^[`nRn Heading 5,5 sub-bullet,sb,4[~@&][^~`fbf Heading 6,sub-dash,sd,5p @&]p^ `FF  Heading 7$$@&a$ CJ$OJQJNN  Heading 8$$x@&]a$5CJDA D Default Paragraph FontViV 0 Table Normal :V 44 la (k ( 0No List JJ center bold,cbo$dha$5@@ center plain,cp$a$bb col text,9 col text,ctdPP @CJ.". |col bullet,cb,Center Bold,col bulletcsb,u,cbbullet,C2 Col Bullet,cb 10pt,col bullet1,cb1,c,Center Bcbold,6 chart,Chart,chart @E^`EN!2N col dash,cd k@^`JBJ col heading,8 col heading,ch,Col Heading,8 col heading,8colheading,9 col heading,e,ColHead,C1 col heading,8colheading,C0 Col Heading$dPPa$ 5;CJZ!RZ col sub-bullet,csb ^`LQbL col sub-dash,csd^`FArF col sub-heading,csh;BB first,f,1#^#`CJ> > Footerd P2CJJ&J Footnote Reference6CJEHH*TT  Footnote Texthd^h`6CJPP footnote,fnhd^h`6CJLL harvey ball$a$ CJOJQJ>> Headerd P2CJBB note,no#^#`6CJRR numbered text,nt #^#`5;NN oversized graphic!]^@"@ paragraph,p"#d`#T2T source,so # ud^`u6CJ>B> step,st$8^8`5<!R< sub-heading,sh%;FbF table title&$da$5CJZ!Z trailer,7 trailer,t'x#$2/..).  Page NumberJJ TitlePageBottom)$da$CJXTX  Block Text*$yC]y^Ca$5;CJ$OJQJJJ File Name in Footer CJOJQJ^^ facing page #,fp,&@#$2/.5CJPK![Content_Types].xmlj0Eжr(΢Iw},-j4 wP-t#bΙ{UTU^hd}㨫)*1P' ^W0)T9<l#$yi};~@(Hu* Dנz/0ǰ $ X3aZ,D0j~3߶b~i>3\`?/[G\!-Rk.sԻ..a濭?PK!֧6 _rels/.relsj0 }Q%v/C/}(h"O = C?hv=Ʌ%[xp{۵_Pѣ<1H0ORBdJE4b$q_6LR7`0̞O,En7Lib/SeеPK!kytheme/theme/themeManager.xml M @}w7c(EbˮCAǠҟ7՛K Y, e.|,H,lxɴIsQ}#Ր ֵ+!,^$j=GW)E+& 8PK!Ptheme/theme/theme1.xmlYOo6w toc'vuر-MniP@I}úama[إ4:lЯGRX^6؊>$ !)O^rC$y@/yH*񄴽)޵߻UDb`}"qۋJחX^)I`nEp)liV[]1M<OP6r=zgbIguSebORD۫qu gZo~ٺlAplxpT0+[}`jzAV2Fi@qv֬5\|ʜ̭NleXdsjcs7f W+Ն7`g ȘJj|h(KD- dXiJ؇(x$( :;˹! I_TS 1?E??ZBΪmU/?~xY'y5g&΋/ɋ>GMGeD3Vq%'#q$8K)fw9:ĵ x}rxwr:\TZaG*y8IjbRc|XŻǿI u3KGnD1NIBs RuK>V.EL+M2#'fi ~V vl{u8zH *:(W☕ ~JTe\O*tHGHY}KNP*ݾ˦TѼ9/#A7qZ$*c?qUnwN%Oi4 =3ڗP 1Pm \\9Mؓ2aD];Yt\[x]}Wr|]g- eW )6-rCSj id DЇAΜIqbJ#x꺃 6k#ASh&ʌt(Q%p%m&]caSl=X\P1Mh9MVdDAaVB[݈fJíP|8 քAV^f Hn- "d>znNJ ة>b&2vKyϼD:,AGm\nziÙ.uχYC6OMf3or$5NHT[XF64T,ќM0E)`#5XY`פ;%1U٥m;R>QD DcpU'&LE/pm%]8firS4d 7y\`JnίI R3U~7+׸#m qBiDi*L69mY&iHE=(K&N!V.KeLDĕ{D vEꦚdeNƟe(MN9ߜR6&3(a/DUz<{ˊYȳV)9Z[4^n5!J?Q3eBoCM m<.vpIYfZY_p[=al-Y}Nc͙ŋ4vfavl'SA8|*u{-ߟ0%M07%<ҍPK! ѐ'theme/theme/_rels/themeManager.xml.relsM 0wooӺ&݈Э5 6?$Q ,.aic21h:qm@RN;d`o7gK(M&$R(.1r'JЊT8V"AȻHu}|$b{P8g/]QAsم(#L[PK-![Content_Types].xmlPK-!֧6 +_rels/.relsPK-!kytheme/theme/themeManager.xmlPK-!Ptheme/theme/theme1.xmlPK-! ѐ' theme/theme/_rels/themeManager.xml.relsPK] " 8@0(  B S  ? #2  hh^h`OJQJo(#2 n @@UnknownG* Times New Roman5Symbol3. * ArialABook AntiquaY Harvey BallsCourier New;WingdingsA BCambria Math@ "1hJK#fiK&,cY0dS2HX $P n2!xxChristian, Michele Christian, Michele        !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~LK\ FT&" WMFC l EMF \KhC   % %   Rp@"CalibriHRO`2H@,$O`2H@ o.1@H <:o.1 ,%7.{ @Calibr ŗ`2s:Lt9'1z%1<:dv% % % !F(GDIC!b K  QOPl0 (Oppp@@@000 PPP```C k                                  H       "             [           &" WMFC m            8          ^                5   2                #    h                                          &" WMFC M                            &" WMFC -                                                                &" WMFC                                                                                                                                         &" WMFC                                               &" WMFC                                                                       &" WMFC                                                                                                                                                                           &" WMFC                                                                      &" WMFC m    &" WMFC M                                                          &" WMFC -                                                                                                           &" WMFC                                                                                                               &" WMFC                                                                                                    &" WMFC                                                                                                             &" WMFC                                                                                                 &" WMFC                                                                                                                             &" WMFC m                                                                                                              &" WMFC M                                                                                                                  &" WMFC -                                                                                                   &" WMFC                                                    & WMFC " FGDIC" % % % TTAEALP % %   n."System-- @"Calibri---,n,TA Op(Oppp@@@000 PPP```C k                                  H       "             [                       8          ^                5   2                #    h                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         ''--- 2 pn --NANIWordDocument SummaryInformation( DocumentSummaryInformation8 ,SummaryInformation( 0 bjbj΀ 0 $$$$$$$$8!% -% $'9%9%9%9%9%&&&'')')')')')')'^),v)'$&&&&&)'$$9%9%>'f&f&f&&$9%$9%''T) f&&''f&f&&&9%q=4$&R&'T'0'&v,f&v,&v,$&$&&f&&&&&&)')'f&&&&'&&&&v,&&&&&&&&& #:         h hjh U    dgd  .:p n) =!"#$% 44Microsoft Office Word@ʗ1@KhM@FJ@(Z4՜.+,0 hp  BOOZ-ALLEN & HAMILTON  TitleOh+'0 P      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwyz{|}~ \p Andrew Westner Ba=   ThisWorkbook=,8{@"1Arial1bCalibri1bCalibri1bCalibri1bArial1bArial1bArial1bArial1bArial1bCalibri1 bCalibri1bCalibri14bCalibri1 bCalibri1bCalibri1bCalibri1,>bCalibri1>bCalibri1>bCalibri1 bArial1>141<bCalibri1?bCalibri1h>bCambria1bCalibri1 bCalibri1bArial1bArial1 bArial1bArial1bArial1bArial1( b Arial Narrow1 bArial1bArial1bArial1bArial1 bArial1(bArial1 bArial1 bArial1bArial1bTahoma"$"#,##0_);\("$"#,##0\)!"$"#,##0_);[Red]\("$"#,##0\)""$"#,##0.00_);\("$"#,##0.00\)'""$"#,##0.00_);[Red]\("$"#,##0.00\)7*2_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_).))_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)?,:_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)6+1_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_) 0.0%                                                                      ff ++ +) +, +*     P@ @   P@ @   @ @        `@ @           +   a@    x@ @   h "x x  x )x !x x@ @  x Zx@ @  |@ @  x@ @  *x "x@ @   (@ @   ,@ @  (8@ @   8@ @   8@ @   <@ @     pUU@ @   tUU@ @   xUU@ @  *pUU@ @      '"x@ @   @ @   `@ @   `@ @  % (@ @  % ,@ @  Q 'x@ @   x@ @   x@ @   `@ @ 7  `@ @ 7  `@ @ 7  xUU@ @ , # xUU@ @ 8 #*xUU@ @ 8    x@ @  x@ @   `  `  x@ @   p@ @  "p@ @   `@ @   x@ @    x@ @    h@ @   @   x  @ @   |@ @   x@ @   (x@ @   @ @   x@ @   @ @  &x@ @   *x@ @    x@ @   p@ @   (x " x@ @  #1 |@ @    x  x    x    x 8@ @   x@ @   p@ @   p   8@ @   p@ @   8@ @    x@ @   |@ @   x@ @   @ @   (x (x  @ @    x@ @   p@ @   p@ @    x@ @   @ @    x@ @   @ @   x@ @   x@ @  x@ @  x@ @   x@ @  x@ @   `  @ @    @       **X *"X (  (8@ @   (8@ @   (8@ @  "x@ @  "x@ @  "x@ @  (8@ @  (8@ @  (8@ @  (8@ @  (8 (8@ @  (8@ @  (8@ @  (8@ @  $"x"  $"x"@  $"x "@  x"@ @   x"@ @   x "@ @  x@ @  x@ @  "x )x !x ||n2"}d}U00\);_(*_)?_);_(   }P}Z00\);_(*_)?_);_(  }P}[00\);_(* _)?_);_(  }<}\ 00\);_(*_)?_);_(}(}^00\);_(*}(}_00\);_(*}<}c 00\);_(*_)?_);_(}(}d00\);_(*}(}e00\);_(*}(}f400\);_(*}(}g400\);_(*}(}h400\);_(*}(}ief00\);_(*}(}m00\);_(*}(}n00\);_(*}d}o00\);_(*_)?_);_(  }x}p00\);_(*_)?_);_(  }(}q00\);_(*}(}r00\);_(*}(}s00\);_(*}(}t00\);_(*}(}u00\);_(*}(}v00\);_(*}(}w00\);_(*}(}x00\);_(*}(}y00\);_(*}(}z00\);_(*}(}{00\);_(*}(}|00\);_(*}(}}00\);_(*}(}~00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}(}00\);_(*}d}00\);_(*_)?_);_(   }(}00\);_(*}(}00\);_(*}<} 00\);_(*_)?_);_(}<} 00\);_(*_)?_);_(}(}00\);_(*}(}00\);_(*}(}00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}(} p00\);_(*}d}00\);_(*_)?_);_(  }P}00\);_(*_)?_);_( }d}00\);_(*_)?_);_(   +   2 +   25 3 @3 + !3   !3 2 !3 + !3   !3 2 ! 20% - Accent10 20% - Accent1 20% - Accent20" 20% - Accent2 20% - Accent30& 20% - Accent3 20% - Accent40* 20% - Accent4 20% - Accent50. 20% - Accent5 20% - Accent602 20% - Accent6 40% - Accent10 40% - Accent1 40% - Accent20# 40% - Accent2 40% - Accent30' 40% - Accent3 40% - Accent40+ 40% - Accent4 40% - Accent50/ 40% - Accent5 40% - Accent603 40% - Accent6 60% - Accent10 60% - Accent1 60% - Accent20$ 60% - Accent2 60% - Accent30( 60% - Accent3 60% - Accent40, 60% - Accent4 60% - Accent500 60% - Accent5! 60% - Accent604 60% - Accent6 "Accent1$Accent1 #Accent2$!Accent2 $Accent3$%Accent3 %Accent4$)Accent4 &Accent5$-Accent5 'Accent6$1Accent6(BadBad) Calculation, Calculation* Check Cell* Check Cell+ Comma,( Comma [0]-&Currency.. Currency [0]/Explanatory Text65Explanatory Text 0GoodGood1 Heading 1( Heading 12 Heading 2( Heading 23 Heading 3( Heading 34 Heading 4( Heading 45( Hyperlink 6Input Input7 Linked Cell, Linked Cell 8Neutral$Neutral"Normal 9Normal 2: Normal 2 2 ;Note Note <Output"Output=$Percent >Title Title ?Total Total@ Warning Text. Warning TextXTableStyleMedium9PivotStyleLight168=,=,̙̙3f3fff3f3f33333f33333\` CoverPurpose* Dashboard) Test CaseshOut Of Scope ControlsSourcesƏLegend Change Log!  ;S  _xlfn.IFERROR  ;?  <? Q@  Á"n-L'Š!6@=n-L'Š!6 ]xxuP[np+NB)RHqNhqC (5H79;ss˞53 #$!B  a95y {H"/}m>f>JleP 0 %$a LгPN'OО OR#RГ5z<]dhȨ(ȨȀ?$"O!3π&נ i|!;ľ~ #O!L_bfiV?uxM=)Tst,!@j,^ @So?$|1OkxII@Oژ4TS,ZC]qeD|G(T)5).*= c9+WkuRX_P=?H_"wC*`&+@(nVV?5}Q{YڼQJ(kqUp:HwI$ Y6 S1gj3+|pO}W xK#.rqH\n* Ip}b'0X PX^qNg&'1Oz^WEj>.6yuɼ{e_@}j| U|QCKeZQ1pM]]( FY/w$թN ǼV70Me/ಥKLMkV#2i^V}jbpGR"p Ҕ;92Py"@0ne;Sq#XlXf"ޗ;-& x7mt| SmL% M._z6WT֑MM/odjQԕhA3ؖe\L6gbbm'Ra+b¿'"Zj0u>_mI`s./.%O|^/&8;ğq4sM޾څ ρo8Զ](bGKIaY, ][AnҬJKy_PcdDŔ8\G/@)?2d#;B륽Eyh5/]%QڔS觍 @-Y'K]Xl捙j-/?xŸ4Ϭ,nlp` $۰?k&Y̨V Bԏs&7t:^2E+8 <m":vKT#|M>޻,$Z1Uza $iET+\#27Uof^`裷B2 #|./Bu~6 Q PYe['4'&vcbvPBJJ> ',gF`73Ȓ.K1{]D6̬>Qj"TnvS^GRƌ8,!9b>7cNitA_q% I+>頹bbݳrXTf%M]ļ~˾ݏ W43JK<*?%^6[ +EH:f*"Oz^ֻa-ߞ 7 w@D~GBͅrW({{34&0PZVOQ jC" X'@JgCd,O 4WhBt;yb^f0OciЉ%FBpѺ+Lј%R 8ݻ#GyB}l{|~\h΂W$% AZ鱄KD&{;3Y:V$ޏ7a(!"s6hy~ m]0)V̲L:]@6"{D,dH/6Ƙ ,eԩpa7:DHi*;^{!GΒaS^$?IoUAyo `/G]|"Ff} ]PU3XWQqJ9=9K9̉,oRv\o Qp7t\*{0-Wu8Ytb;އ,cʥkGjp/g pdydݤ^Np7!oI oJ7n_ڢaZ W0Jq >|ǃS2mQ L[@<3u@L0LuȱY%}fH@O{v:xnd?Ug'%Ư; uNc}nLR#zo~#SʞiΒ7?2c79L_nn|+-33 :İgg|cqHeQrhe{jbX 3qH0^A9`}e`B˛FpVnt߂ߑp҂]ׇ1L@uVWw*5wL~|нA61oRLqW ma XVu]SX*H YmKf-8p*g&{|g֊ M 6M?Xcj PXȺZa|5f@CH6BoCuVUue2h4a0dέv*[ڛQsT c,yڌt*7X"BUx\S-*wF+5Fihgoq:ɿ{饗uS° l5DLNh mE[^hbC?X|̮LfdqAi-kFL8KC]vDUinmiֶGac4LW"2?dd;WZXwxMfKT[`0lR Ey I_ .ةcI9^ >ER}E>4G JYӣ3pMQX<,4eۃ~ VbuITzڟضGFi1X^2UQQ8~N1$Y[B: ̼pe&?vK KČPtv8iF)xxōs9^Qi,K!ْP̼7] ^fhO4g+GU=-ۈo$x+U44@DCߐW^kv(Tqļo%߷x.'J^^ 8>AME }R*bA{=w8V!l 3բdC=srM z6lv̜vӳMr63hv()+IR~WS5XiFcZL^G}'tXu@|G!S s$ v/_qA ŋ+(Ը;o>-O m $бՔ}:Ni0JN5ȂC{a3AV3̱A$K )wTJ1k@;+#@dt"0/wҬXAmn:TdϬ;C^|'M@;|"\M)$(ЯC|_gϲIO85޹X/2<{-&ԭumVҿ!*WEE%S5,"0*]A#g,B*G{TBsO^"J=Au t7/O-]ŭ*eR9gVՈk7xx = S.hW+W)?۔iy(;Ep^ATVٻdτ991 epIE‘TLJ BL[zް|z7Z-c1)j ul@ 1`NvśPV@hRV#9pb&h\ n ÑCPxS.J}}I_ݸʖ" ?M~0Czu7v, ޜZW_rqq{<[(PH\sUKR/C: =e5G;'wR5zj1*LfP>Z,gR>m>w(#p#oF#l71t..6*yda L#cQ%KQvw[ d@aD|I7re>Fő c76S$w"$7dX6׌z4Avb}(3fmYH$dUFo\ifzUCG"7U8xd?!RDBcRւ%iʶw'h3?Fhח\$]Ef{:cӮ_6u]wA d !s6ԇ-ڋ P' ^/(M&5W0b -tvk{̋s&#&+vs'4o.~yFI4fO|3aCzIb!Q-R!gS.A'< [@iגaN=^O <؃}JJyoIc>=Um8o|$r-S[Ѡv Z8l53&TTw:-K2ӷrÅenCa".}V_%\;;cP95*ْ>RxW6΃چDG$-w|!8eGL٢!>^L [+ 'jh7dV᯻$pGϾCcSzX-9 LڳLAj;Al;xfhMr evL}P 82>yCE8r*_vZy i|)'Ur-v焃hX'C0Z<ʞoơ$g%VjQ6U]My.Xtpsƽཟ ہߝ͕\rDi$;SiG'#%UK% f:mg&Ƭ;f >G³X]U+|yV@\K_E8O@7 ;$Ƥؽ68߸]ZrwɎ=MVOC4'$Q >h&Dm $)-̇zAu;Un /w3CvQqL;."ݶ֩4ʽ22;ޔqۣμV`'/vС*N`(un;[M+͘阾)9~{[p * }ݨ r "J ! K"u{pTIi0íofxe%em3&G+p}?Q.e!Vjt$^-U74-R NIQM |o7aA<[*&"jXqIM#Rzhq_4`Y۰evo''U#ԇԍοž&CJ8k֙fj`lEu!Up+M1޶y>(:|B^{wů;-W}\717,qCD-ׄj :'v~`Ԛm`Xp7~]5XVݾD:l"WgsqxBAKTd] ՎiN+ߥ F\ڤ>ƽ9.Ѱ<6<0`70?r4w-d&B' a{aaÏMxJwM/#>.9n7KP O~~G;҄Upj٨S%^^m<5Wae;9V @9凶ߠ˺:mmj旖ӭ](4÷ucbZޥL1uLK#]L+%.$_R'ώdq9+jIC ws*R+`!-2|ODLdSk o/+b2L8Ȟh/cr{YZL&nz1â"9꺣cVldd73n#.c>ݐe^cRӍ1d|tV!/ 6+ 6mP-ώoMNթ$e5w0IIf"CPߏo. |Ӭv tlz[;{*B-'. Nj)(Tz哉T7̈́aE8˪"Bs40yv)X`mS +fxa<(|2F]{F>%9ٰt888p1ܕɳʶ3ݱ'ޱh?}=ಹ2͞("ܴ䆲rݵ!7ݱ%2]nň/2/8r;Zb5Fy kW3z |ruYNNyh ) Jp4y9BN.zfES.յWvDh mĹn s$B٧GDὐK_x\Txۙ-F<R">Vubw$YTII6z;gcdҗ  '"= xn6a*jg/mDΒ>Da攷_a\Mz뭵!U 0|+JA,T ixd"jm 'GBXGtۨW52z[R.2.;rsAʴi0آէe-苼gCe;*?2OнIXp᧤6qߜL;Vh٫!7Rr Ѱ\WP0u} 'TV!(|`rQŚPuk]yc⛲箑8HIKZfC]tsD íxyM70Uƙ{xX<_~)/oǚ]? <nHiT\O;m(,u%T(T*WQQ%[RHITv/̙{/z|_ϯ˼Ҝ99>9̜32'=/1>ǃհշ [8Ǿʑ辱9<*YRڥg 'j)5h}1QB:ӗAf ݜ+d61]Jaio9$dnG}i{(R7@bJPפ8CvXtzɓTZZ-;w.~wJNjJPBw{I!ߊSK&%UiRu.Y\֊2LpJYG?&S;^iWJYK`+#{n J':?m9,UoIm鴍UG~5JƁao2-L~A-,eGN?sڬX'|UCw7um{iڲ5S^y]fʻ U:}((}j-˚?pvN7v&gw 4u})n}M-v'>GuGWث9;շYcR([C9{D ) jIAtEm3~rh皁)x&\rJLq𲊦5?[ݕPЈ}\15MI*CMp# Wq6KO, ^e u6$ `n 4>sY,k^ֺ8UM;أz%Jf!wNdʮقЌECW7儧Oy%{"ar9G~e\k$~Tؖڲpmq޶$M4w1+[bSf1 &N`g֌ܲc\y &Yr 9딙Aɱt x;+J{]QY4概&)ComsZ$OejM'~ xb>V"U=k"D}RMcLDOC3 f}vrlm3<)u:18s<K7Hl2i`IT2u\/דsGԦs%q~SO\buI Ȯ$=:y]n QASWggBl{^bӷӯE ؔ$Yn,UtK>6jJLMr /KxXeחȎ0)1ˏ kSkm;ywDWtX`G&kJ4MV$捁fN$[NַO-{_Ϊ\Ƶ!?潵Okb-hjȴ r M]S<5H~.˛cӅK^Ŝ*+Km\%;[GxbVgQbܪd7x涓?]qr~F^m_g DQ#b%wvؚ9MO4Nȍ齧qL)d$tޜ["֐㳒gF^6T?ɻqfS{y`[K6uA/N+""Dsܫd) YY?%)o`'ԁ?oVTƅyu): W5T{d/Z[W|obyBԽ_cuBӊ&3./g΋9=uSsJi͒'8x&w{lk66_~ڱ?s-7OX~9F"g996ÏNOZ"U㶙"+RU?Գ~k9NǼu,~}'5SԹJÍvū< >6ճМC~緡8|;-%/̴ܰ>/虾6G9Ϲ9Fi$rժ9OlǓX߹eTzb}A52.aE8LK"&NiϱxauY># dۣUH%=lt3wY?X;qzU%ZZT~ZdHTY׫G__zڀ*E.ע'zZ YiL |ݤ+S+TU.kFnoi20Wkh^qyV5̑ܝ =;*y)ebʇ-$ Y " ǏN=3Wl/;Uwǹ"_Mso]aE|GL^#@4y`%qc"%~z]W/t FjvziARC6&LzQe3͏S]ǖ^PLTvdj%M+^b(S_zݬ*G-&%"~@iod&z\Pɼ=-rC+0ku W=u÷G[CH[Iۤc0?" 'B[TJL2vSXIC+I{M??H@BI:6noG7@ 合c2yCByhFБ5)SżLjAI(XV 6&/))$%%aD"inn9r|r2FVVavڅp6y%M,v8ϱ%0s[in"\#҂S[SxD7O#qrR33\S&/ AQ.^0h{0 /@a.5RmD0yDW'/R8C+An,'>&.A[mj"I-O9QQZTPv6dMq(S@4!?$ L-O* F:iaax +:,( p8#DZ(L dǓ:8/ :2}{<Bf^_7ôOdlxlBB` "lyG&71OC)CU;Ba(;Óat710 `" <)*&gx#T9NSQF 5"#lH"\+`1aѓbϚSգaUǑDF$|9B5'%(F 0kõ$mk t<J # Aʛ ZucWfsDΓ GZ4Bգ3,ESe8Qh .Ń虡2i1,y1[ PưBe1b̴;(7yʐu%0¾³ R\ zC&KN NhP-Mz4B DF`m-g % TJMpJ hb9ZOU=Kv"XePHy#efe`GHФ D) a0P Ȧԣ'R̟OJ4.# d$+ "H?IkR@KޯCPgXȆ)*5X4B  _ARnbsF: 0DA]IO`|$ 5.}JUyDKQgDIgOhsr0;| I'=u")3P9$ EOSIj+HE`S(y eIV:(%Gt iDG4xOa.n~#7ɿ< xm# C;G>Ԧf90ưűI΢yٹ()N03~ T8CX^ZiaDZ؎(b C ״$AP (9*85 }< L`c@Ul[#VBd'@Ʌ|@ɦ̍Cefa@!LaF䉈J 4'p%UVzo +M!p$`kDBଅĎb~2˨4Fa"gGbޖ!'{C BȠ<#"yBb|< ;9*Mvy"[bh} 3Bu1Lfx2j!;JuG'eG͠劲GE&XOg/fn<"8r9A/T?#&CyEE2VU<'*17G$]3ԙCĂ?Zȸb]#ӡ=/BW/WEAOmi7{Z4-X4#*~ O^TT2~'0?+_6<#|L͝öGFhe5y-6ԟ<ǖJqcK`l8ϱ%0s[i9sl qxBӽI(L u &)7WTX>0Hi7x&Ț.` \IТ:֯sA1c@?Bϯ0?KJ u*2*0b ?l/!ײ>f\CCr/%m DsXPg:C9? RgMuQȨ2> Damlx2V]є@Hf9 X,Oe [t伬2& ʗYز1J/I "xf "$'6 mvpptk8D-~ OvL OYW r^ ,::aH, {/݃>O6QIKj'3t&A@ဗE>E^ck1^Ht~  WxL\"$ j7## [>W 4bzIӂxPx5Jm(EAb`eqS)LO{G4zL"~xhg>J2X1HN"/9"TL2) ^MiQ(A8 $? VEw*AyChoSѐ4@DCڴnq3!"<?,#AKLlm-ğ(BI,-szkT]s6[ә_DH).;k+1ə݉͏kIE1yjV4u&C&7<=Lj^EwR7Ϥ(&ܝx*ItnԺ#\"! p)7kg΂Ԯ)RZj<>'qQPbOs&gb.Ll],(3weIdM4ۭONH:5~WԻn딏 (_ {TA@ȅaN`9=?Qnwq#rE? ~[{*w9 zO, Kү?eA¼V$OoiڊaxS~~8NZn;զNƗ _Ts `!ODkK sCJ+)V,E&KR|tOۀ\w3Wm-7h7XdO=#cVEELŲv+&sCG!}~89j_i }"Ucex uPUf3/ TPN7?r$(sR<}\x>>9S=n.3[P&RFuj^ N<'*<F[gYb?aij^GMg|ΰ#7Ey¯pr({oVȟ>ﾝ, TK`uuG_7"+n+ ^N,6Jyd[T F=gt͙M qa- ;26~5y 6e >-հ{/*ĉ#ڿqu<:v7V D;6 kywwiCN!'>VW@Տ 'a`ůݮ_gّ_\GAn _sbǴJf!}xJ!}xJ!}xJ!}xJ!}xJ!}xJ!}xJ!}xJ!}xJ%+3z A\$[WXϧ ďo<}2C *+&%;T_^|oiih~8=^wL';M?>; ]{]܃lx!+/tiz<Q*AL'B!r%ZѽiQ3 ~TF|b2]a{տDW/--SÓ^t(@@1tmkM7z.m9]“^5V׶S؈* 9P)KEm<2Yv<]aa)~ϊ"[Aa6rSs}vgXR#; rFe/O%trohF"QRٳX a3VeOqxZagM0Cyz '<}W hnR}g(iWj;m„D7e/wo_+/Ņ:yʎI﨓+.=}s*@{Yq-Ga8<=:s7s<O@aO $; Y6pÂ8Kח[k ý`f~[lҔ?%wp{ϋZH CMlzu~kO7k):+:/aհx OфXH ;ҭ+'dz$i;Lf8Gn/YT-Ӓ`8(Ӧ.݂ m|;3?8lӘIqQǾχW ̃2c5~__gaOvi9 o,ϰUkj[jo)8d.+q˧A<>%Xsۏ%Ί)Q^ @΍qKqƍ>}UjR/]ש.ue/3 <ʘ}RGy45X gOԂnsTx[~/Y|zk~-y TRQ &SI_HBz/lYkx><~`o2FpQ2G?O QrE텛'? sY9óy,?y=`2-gPW-@xЛG@ a@p(pZ]ӽ)!X3|sdgfOoS r]uAX)?`b&'kmœ(WHi.}|VꃰR߱.rW\ ),cmpJ];+Ox^ ~r+tx:@6( v<}$joG:uoxf5~O|woِz$k) !U{G6@J7˹!ͣrכ ecoGoDCUיvo"es49m>xvǛXM@; +u/VkӢc)=/2ʰdy7s34 !׍ 0qW1Vn [,p&[629iXI3+:{Iv=f`n5Lzp<;!4>elwX0:OhyO9*q{ z][^8OAqdu~<3Ka>,s .=xLU;%@dz [˧:BQ;h (@퐊WX\#&}Hi'F.odzڣ ᜖#Dmѐj5>W#vn҉9wnljBnz'#CPhm`-=`fHZ]#wQ(cCΔ dHUs~tCw1Df'&A⽹.xa ;|^,:ZH'w9g> #$$Dko % s_sh~A(]{4[_&ujI Fh `YuhAxLjZ W}kd:O,A<*S >βgI9̦:=<3eό=MG^TFPE4Kx$I?PWM߈jwRn튤Pww<4 6Q/'u" &шm9"uxR./Itp":uL'Gʛ+oK$\3Nj^r}-xk * m.'`6*o=~!*mhsAp$U͑H v b"`n 3vdELb+Tt{p@aC[g-Z~;x<7OqYckJoX*/Uн*Υxp23I%DFMI8+е8>'چkk [Ϗ 3,J65*ʁ&29zN6v{ m6#$*h5ҏ`RQ #XMGj>>q,`@v'PJm'i 212ueƦ4aKPAJ*)2>+Zɷ4%紳(5?s<|tआE6cɧs7.źx253͍FFs'.&ճGM= J6ڠf%"#_ҤTmD;6xz}}6TGVOj(@j~fVDGtZд҉(9'7-jL+z 7ZP5™rw,m5=g #L;*wZtk'4E t>UqlULIEa IQT* k?TdwEC4o7A@_ 1Plz[Gu $:X<ɢ&mR.Ӎ8׋a|k'uU#Je:XW4I_gynafl!T,~E6KSpQɅOY/C*BL`0jn;mxׂr*}ѡ4uojHzx3OM T߱r/:U8 ŊMJQramoktf-ݩN!6vRCc'ibyሲB#2 G pƩ 7+DџlnN~wҠ9F+CPCՁ9Ak\oݶ`4x7[khhNMVO JUӸ{P ?^@!* "lEaI_{LL0P’s~y iΗ/iOl5ѦjC#+2-`SJHRJ ҽpl3MȊC_ϵ]t_լ@@%lx-RYiv fB;$Z(2"u( 5bhRۇb1Mwh x? \&]IU!ʓsiR^i\&K5ã0)vYU20PYo*> ϯC 5*4qPI`^碷Sڐpz d)*V D渡}Uotvw}:8y,?UX>gBAfC6*5xy5i 6\*h`?@.O{!u> S'AF`!sw5rPUƞu0C+4Q"kt7U;L)v{:+$B6|OCo'LĂ^AE-f|5iH%&Vm-RbJKJUe]l'gW n4) ]k\d(9j$qh1nWn-/ ç1;$NϏ-$?2Uj<ڰy}DVj5G}>% ' jEX\ Lju=vJZܩXz} g_,U7;W#&vWv %xvBg2O= {2pxd}˳jbGlJ96E|r[f|v1~h'z 7tTdnr'X5#_URjT|/OE0@;ÓE6DZ}K>jʉ h 7 N#߅i> -='Ϩ8ވ cAAV15.s %,;}}O(mw&ҩbV':G b^- /C3 =(Su+Y GzUygĽxPFJˀ71x}RswB7R8˅發(V+5s/Q{%4\ BgwEa@YfA͆[ S,^p'6*Ym(2kz<;ᓼ [Hb~`$qUnĒVbYz FK#om <b=hZlxr kG_K"h"f5;$`t7آ"K_ۯ=! \v?Iq7@AlQDSL\ƕ>L6w\'ƕ.|x@6M>>+h@MuL8}8Q\(QtBGtC%GeI_'czǰc]F>T7fF>KN_Y]kEcjRFaq_xc]  32]<}|0g 3A\ُ(|wcdg-5% .C/_!a2x^34n<1|JL6o)&v  ؒV[{{~E&TI)q+?|Vl^<'0-z8HW[Y'QfH'y he koYU ʁWQhD%I7:Փv: IP1N@_H < >Б _A%ZVRȑ#w"z\_ܝ˰ҙ7e%ՅkD7;>U^ЛWl#H5 ُ3QH(=ـQ_* <>9) şE

{ EӶgzdL* QKvK U$'^}7,$Q42t`3$ #8q?ަ)~|ֲ'N{mqxMzO09Ny$Peu|le.C7"v3 #,o;Ҏ8H""RGp~"G36I;peKqp4N *>;>uV x6|iP<t@哮TsMC!mnzٲOxR4;㨭%PiB\X0qx4LY'LH&/{ZK?\*.2Zt`c' =r`ـXzoց5Cy ątplD`(>5*M$ՅS㝲]rƳ֞4oo/zk,fdz4}Ϲy5;໖ p><촠>UKx}^x*3`~]7Z]x1(Ǧ9Hh| v޾7Čz<Bpl+:Ғ+ ǚ{uՈTp'hu%FxUvI7DD_OFnPQÙCq E*gB녟wr~ |!6P9Z!NfGv9+atg5+ dO'vтyhT=rTE?>و!Zdѱɂ31İհzʰ±<,d #]akCJko_"EOǚ2#<1TjIm{oSZ]=$W%!ӤH>c!L%ٟfͱէ\䥱败:I&݆[x[StxːFg̍0ZArtd c<ˤ$Rz!k#%\]W@,i'GN_q*YI5bƔ:|' @KƗ^?>'#?Fٳ>"t:Ɠ<[ NR>ވZv )Eh>sS (W*N`}$ќ3Qe@^IRb\1ћb*TfMFbEҥ6Rc&6K1 MƌB%oRU|sxNMގ/ZU,%g5%ޣHpܮT19ԒjфMY4J[6 ֙'<< x3h&Q>ɽ7OhHDGgu -#)I#/rkxb[8$a״Ot^gMOZ2Lyp6L5ѹ6g,yqa2xiTxBQƽ떭`Vq$mcgk'DHa[aGuZȳy$̢؉NpG5d &K3utϡ߬g`NHPx4Ĉ4!QQ# !̏:Jr%$'wlwHdހo Ert=86W-%ZB>&~4;W=\ϹÛw: *.1-/ZON܉gp,7lxC> H9VAH4紸.>;'s=L< j{^ғl4@BQCwRR\m?A&9\ B2:vEpecHޞ 'gX9b:wl4gGg0^cfdx*\t;a]N0 #?9Cu9i@y8@^<"93?'nwBr@dwZ+' jH1v ?>Nmm 9=ns ;_v.:[ Gqc_'b~幞%@]sX.Nrj}NdUy$3yMhm|=TQ4?Ceuo fi,5< Ӎ|V>ֳ0S鱫!|)܌[Xs-:$kϵ<dߦFV]eNO>Mjy%ngxDP/EMۮd8_6 m{S<|~ǬlI:;( X3'V3lմ!|==ʻ巡<"k.֌F UߘxaO#tBq0^`~ڽ hO_X %Cߚ˳gx0cXgJougL<׉=RbCկ8.$w3ɠxag7?|->kC_8G:q^?kO~g:׿Ÿ%C?niO_? B忖!#Ÿe/+OΣ3Ӈ3D*GO ޶Ro+ 7{S AA@A@   (Updates (cont.): -Test IDs: -Test ID #7 Changed control to IA-2 (from AC-5) -Test ID #s 10, 12, 13, 14, 20, 22, 23: Changed control to IA-3 (from IA-2) -Test ID #25 Changed control to IA-2 (from CM-3) -Test ID #27 Changed control to AC12 (from AC-10) -Test ID #s 29, 30, 31: Changed control to IA-5 (from PMG-x) -Test ID #32 Changed control to CM-3 (from SM-2) -Test ID #33 Changed control to AC-14 (from AC-3 - switched) -Test ID #34 Changed control to MA-3 (from SM-2) -Test ID #36 Changed control to AC-6 (from CM-3) -Test ID #44 Changed control to IA-6 (from CM-3) -Test ID #62 Changed control to CM-3 (from AC-3) -Test ID #63 Changed control to SC-4 (from CM-3 - switched) -Test ID #64 Changed control to SA-5 (from SS-2) -Test ID #77 Changed control to AC-5 (from SC-2) -Test ID #80 Changed control to SC-9 (from SC-3) -Test ID #81 Changed control to AU-9 (from SAMG) -Test ID #s 82-90, 92-95: Changed control to AU-2 (from SAMG-x) -Test ID #91 Changed control to AU-3 (from SAMG-x) !1/27/2009 -- 5/18/2009Confer with the IAM. Verify that procedures are in place to review audit logs on a regular, periodic basis, and that these procedure are followed (i.e. that the reviews are performed). Inquire whether automated data review and reductions tools are available and/or in use.SAudit logs are reviewed on a regular basis. Automated tools are used if available. Confer with the IAM and SA. Determine how remote accesses are managed and controlled. If remote execution of privileged functions (administration, etc.) is permitted, ensure that such privileges are properly justified and documented. Ensure that remote sessions are properly encrypted.The organization authorizes, monitors, and controls all methods of remote access to the information system. (1) The organization employs automated mechanisms to facilitate the monitoring and control of remote access methods. (2) The organization uses cryptography to protect the confidentiality and integrity of remote access sessions. (3) The organization controls all remote accesses through a limited number of managed access control points. (4) The organization permits remote access for privileged functions only for compelling operational needs and documents the rationale for such access in the security plan for the information system.KRemote accesses are properly justified, documented, managed and controlled.The organization allocates sufficient audit record storage capacity and configures auditing to reduce the likelihood of such capacity being exceeded.With the systems programmer, review the size of the SYS1.MANx files, the %-utilization, and the schedule with whish the files are dumped (backed up) and cleared.PSYS1.MANx files are managed adequately to prevent the loss of system audit data.nThe information system alerts appropriate organizational officials in the event of an audit processing failure With the systems programmer, ensure that the system issues console alerts when the SYS1.MANx files approach critical threshold. Verify that the operations staff has standing instructions to notify the appropriate personnel, and that procedures have been established to dump the SMF data.TThe information system provides an audit reduction and report generation capability..Data reduction tools are available and in use.Confer with the IAM and the SA to determine what SMF data audit reduction and reporting tools are available (in addition to standard z/OS SMF reporting mechanisms.)The information system provides time stamps for use in audit record generation. (1) The organization synchronizes internal information system clocks [Assignment: organization-defined frequency].wThe information system protects audit information and audit tools from unauthorized access, modification, and deletion.The organization retains audit records for [an organization-defined time period] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.Policy and procedures exist for setting and periodically synchronizing the system clock. Note: Audit data (SMF) time stamps should reflect GMT time.Confer with the Systems Programmer and IAM to determine the site policy and procedures for setting, verifying, and synchronizing the system clock. Inquire whether the system clock is set to GMT+0 with a Time Zone offset, or whether the system clock is set to local time.BPolicy and procedures exist for backing up and retaining SMF data.The organization manages user identifiers by: (i) uniquely identifying each user; (ii) verifying the identity of each user; (iii) receiving authorization to issue a user identifier from an appropriate organization official; (iv) issuing the user identifier to the intended party; (v) disabling the user identifier after [an organization-defined time period] of inactivity; and (vi) archiving user identifiers.The organization manages information system authenticators by: (i) defining initial authenticator content; (ii) establishing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators; (iii) changing default authenticators upon information system installation; and (iv) changing/refreshing authenticators periodically.The site should have adequate procedures in place to issue, manage, revoke, and archive user access credentials. User logon IDs should not be re-issued to new personnel once they have been used.The information system separates user functionality (including user interface services) from information system management functionality.Interview the IAM and SA. Determine whether privileged users have separate accounts for performing day-to-day user activities than those used for performing privileged functions/tasks.The information system protects against or limits the effects of denial of service attacks. (1) The information system restricts the ability of users to launch denial of service attacks against other information systems or networks. (2) The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.RThe system should provide protection against flood-type denial of service attacks.GThe system should provide protection against network session hijacking.bThe information system provides mechanisms to protect the authenticity of communications sessions.Tester:Date: Location:IRS Safeguard SCSEM Legend(Identification number of SCSEM test caseNIST ID'NIST 800-53/PUB 1075 Control IdentifierObjective of test procedure. Test Steps6Detailed test procedures to follow for test execution.LThe expected outcome of the test step execution that would result in a Pass._The actual outcome of the test step execution, i.e., the actual configuration setting observed.Comments / Supporting EvidenceTest Case Tab: Execute the test cases and document the results to complete the IRS Safeguard Computer Security review. Reviewer is required to complete the following columns: Actual Results, Comments/Supporting Evidence. Please find more details of eaReviewer to include any supporting evidence to confirm if the test case passed., failed on not applicable As evidence, provide the following information for the following assessment methods: 1. Interview - Name and title of the person providing information. Also provide the date when the information is provided. 2. Examination - Provide the name, title, and date of the document referenced as the evidence. Also provide section number where the pertinent information is resident within the document (if possible). Ensure all supporting evidence to verify the test case passed or failed. If the control is marked as NA, then provide appropriate justification as to why the control is considered NA.Procedures: Review the  LOGGED PROGRAMS (LOGPGM record) section of the CA-ACF2 Control Options (GSO < Record). Although access rules and other options (e.g. GSO Control Options such as (a) (b) and (c) specified above) control the use of these programs, the LOGPGM record provides a facility to produce audit trails that log all datasets accessed by any of these programs. Determine if the use of programs specified under the following GSO Control Options are logged accordingly: Procedures: Review the TAPE BLP setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. TAPE BLP denotes whether or not an audit log is generated when programs or users bypass tape label processing. Procedures: Review the STC OPTION setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. STC OPTION denotes whether or not a system/started task must be authenticated by ACF2 before access to any dataset is permitted. Expected Results: (a)  Restricted Program Names (b)  Maintenance Logonids/Programs/Libraries (c)  Tape Bypass Label Processing/Libraries Procedures: Review the JOB CHECK setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (JOB CHECK denotes whether or not logonids submitting batch jobs are authenticated through designation of the JOB attribute)Procedures: Review the MAX VIO PER JOB setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (MAX VIO PER JOB denotes the maximum number of access violations a batch job is permitted to accumulate before ACF2 terminates the job session.)Procedures: Review the UADS setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (UADS denotes whether or not the User Attribute Dataset (UADS) is used for TSO logon procedures; UADS=BYPASS denotes that UADS dataset is bypassed and TSO logons are authenticated by CA-ACF2 through active TSO fields defined in each CA-ACF2 logonid record; UADS=USE denotes that user TSO sessions are authenticated through SYS1.UADS. If UADS is used, review procedures for the control and maintenance of the UADS dataset (SYS1.UADS). )Procedures: Review the LOGON RETRY COUNT setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. (LOGON RETRY COUNT denotes the maximum number of unsuccessful password attempts allowed before a terminal session is cancelled.)tProcedures: Review the PSWD REQUIRED setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.qProcedures: Review the PSWD ALTER setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.oProcedures: Review the PSWD-JES setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.vProcedures: Review the PSWD WARN DAYS setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.Procedures: Review the MIN PSWD LENGTH setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. (MIN PSWD LENGTH denotes the minimum number of characters required for establishing a user password.)oProcedures: Review the PSWD-LID setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.qProcedures: Review the following settings under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options.rProcedures: Review the following settings under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. tProcedures: Review the PSWD NUMERIC setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. qProcedures: Review the PSWD FORCE setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options Procedures: Review the MAX PSWD ATTEMPTS setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. (MAX PSWD ATTEMPTS denotes the maximum number of unsuccessful password attempts allowed before a user s logonid is suspended/disabled.) Procedure: Obtain a user logonid (LID) report for general users and for a selected group of privileged users (e.g. Security Administrators, MVS Programmers/Support, Data Center Operations). Review the value specified MAXDAYS field associated with the aforementioned logonids selected. (MAXDAYS denotes the number of days allowed between password changes before the password expires.) DExpected Results: 90 - For standard users 60 - For privileged usershProcedure: Obtain a user logonid (LID) report for general users and for a selected group of privileged users (e.g. Security Administrators, MVS Programmers/Support, Data Center Operations). Review the value specified MINDAYS field associated with the aforementioned logonids selected. (MINDAYS denotes the number of days required between password changes.) EInactive accounts are revoked/suspended after 90 days of inactivity. :Network Job Entry (NJE) I & A security options are active.hACF2 displays the date and time of the user s l< ast system access whenever the user logs on to the system?User logons are terminated if wait time exceeds two (2) minutesThe audit trail shall be protected from unauthorized access, use, deletion or modification. The audit trail shall be restricted to personnel routinely responsible for performing security audit functions. \Programs that can bypass system security are maintained on the  RESTRICTED PROGRAM NAMES . Entries included on  MAINTENANCE LOGONIDS/PROGRAMS/LIBRARIES are restricted to the minimum programs required to perform DASD maintenance or other related operations.Programs and libraries specified in  TAPE BYPASS LABEL PROGRAMS/LIBRARIES are authorized and approved by appropriate system personnel, as needed, to bypass tape-label verification in order to perform inherent job functions.$To determine if MODE is set to ABORTJAccess rule sets are sorted in the order of most specific to most general.+Tape dataset protection is active/in effectFDASD datasets/volumes are protected through list specified by RESVOLS.QDASD volumes and/or tape volumes are protected through list specified by SECVOLS.SDecompile authorities are restricted to logonids with SECURITY or AUDIT attributes.YListing Infostorage records are restricted to logonids with SECURITY or AUDIT attributes.VUID string modifications are restricted to logonids with SECURITY or AUDIT attributes.PUsers are prohibited from entering their username and password on the same line. ACF2 intercepts received controlNMVS System Authorization Facility (SAF) calls are controlled by ACF2 security.Procedures: Review the  SYSTEM AUTHORIZATION FACILITY DEFINITIONS and verify that the SUBSYS parameter is  ACF2 . If not, evaluate the feasibility or potential security implications of SAF calls / request not specified under the default ACF2 process (i.e., installation defined).>The SECURITY and ACCOUNT privileges are adequately controlled.2The NON-CNCL privileges are adequately controlled.1The READALL privileges are adequately controlled.-The AUDIT privilege is adequately controlled./The MAINT privileges are adequately controlled.2The TAPE BLP privileges are adequately controlled.1The ALLCMDS privileges are adequately controlled.1The REFRESH privileges are adequately controlled.OThe RULE_VLD privileges are included in the Security Administrators LID Record.5Access to ACF2 distribution libraries are controlled.=FTI datasets are restricted to users having a  need to know .dALLOCATE (ALLOC) authority to core MVS operating system libraries are restricted to MVS programmers.8Logical access to ACF2 databases is properly restricted.NSystem exits specified on the system are authorized, approved and appropriate.CAUTOERAS feature is specified for FTI datasets and related volumes.@The use of powerful programs and utilities is routinely logged. MEnsure programs and users that bypass tape label verification will be logged.>ACF2 security records are properly recorded in SMF audit logs.MEnsure ACF2 verifies access requests initiated by any system / started tasks.Procedures: 1. Request the System Administrator to generate an ACF2 data set access report. Review the report and verify that access to the SMF data sets (SYS1.MANx) is restricted to authorized personnel. <Auditing is configured to capture security-relevant events.TProcedures: Review warning banner online to ensure compliance with IRS requirements.kProcedures: 1. Obtain the Access Rules (report) from the security officer for each FTI dataset. Note: The applications programmer or production control group may have to assist in identifying all FTI datasets. 2. Through inquiry of appropriate personnel, (data security, programming, data center operations) determine the name and job function of each user listed separately or within a group on the access control list. Determine whether users having access is appropriate and based on need to know and the least privilege concept. Given the nature of these datasets, even READ access maybe inappropriate. Note: Data Security, Systems and Application Programmers, Data Center Operations, and Production Control typically do not need to have routine access to these datasets. FIRECALL or EMERGENCY IDs are the preferred control to grant temporary access to FTI datasets.FPassword history prohibits the reuse of passwords for six generations.>Passwords are prohibited from containing repeating characters.lDefault vendor passwords shall be changed upon successful installation of the information system product. Procedures: Interview the SA and IAM. Verify that procedures are in place requiring that default passwords for installed products are changed as part of the installation process.Users shall commit passwords to memory, avoid writing passwords down and never disclose passwords to others (e.g., with a co-worker in order to share files).'Procedures: Interview the IAM. Verify that policies and training are in place to ensure that users protect passwords appropriately. If possible, walk through the office areas and ensure that passwords are not written down (e.g. look for sticky-notes, passwords taped to keyboard bottoms, etc.)~Passwords shall not be automated through function keys, scripts or other methods where passwords may be stored on the system. Procedures: Interview the IAM. Verify that policies and training are in place to ensure that users understand that passwords will not be automated or stored in clear text on the system.Procedures: Review the  -- LOCAL EXITS SPECIFIED ON THIS SYSTEM --- section of the ACF SHOW ACTIVE report. For exits not = NONE, inquire of appropriate systems personnel as to (a) the purpose of the system exit (b) the business justification for the system exit (c) the system users responsible for maintaining the system exit (d) how ACF2 administers security to control logical access to the system exit code.^Note: Due to inherent weaknesses in ACF2 password security controls, some installations may deploy (with installation-specific configurations) the NEW PSWD VALIDATE exit routine to enforce a more granular level of password controls, such as enforcing alphanumeric password composition requirements and enhancing password-history parameter controls. aEnsure logonids submitting batch jobs are authenticated through designation of the JOB attribute.aEnsure access violations, accumulated by user batch jobs submitted to the system, are restricted.OTerminal sessions are cancelled after three (3) unsuccessful password attempts.FPasswords are required for all logonids (except for STC and RESTRICT)..Users are permitted to change their passwords.WPassword violations accumulated by batch jobs are counted toward the MAX-PSWD ATTEMPTS.CPasswords are prohibited from being equivalent to a user s logonid.< GPasswords are prohibited from being composed of all numeric characters.;Reserved words are utilized to enforce password complexity.tUsers are forced to change passwords at next logon whenever someone other than the user changes the user s password.JUser logonids are disabled after three (3) unsuccessful password attempts.LPassword change interval  MAXDAYS is appropriately set between 30-90 days.cPassword expiration warning is 5-14 days before the password change interval (MAXDAYS) is enforced.0Minimum password length is eight (8) characters.Expected Results: 15 'Procedure: 1. Obtain the ACF2 Super List Report for all logonids defined to the installation. Review the right hand most column that is a date field. Identify all logonids with date of last access exceeding 90 days from date of the review. 2. Verify that the logonids are revoked (i.e., ensure SUSPEND or CANCEL fields are specified in the logonid record) after a period of inactivity has expired. 3. Determine if policies and procedures are established to revoke inactive logonids after a specified period (e.g. 30, 60, or 90 days) has elapsed. Expected Results: CANCEL or SUSPEND field values are specified in logonids with the  Date of Last Access field exceeding 90 days from the date of the security review.Procedures: Review the  NJE OPTIONS IN EFFECT section of ACF2 GSO Control Options. Through inquiry and observation, determine if site uses NJE. If NJE is not used, evaluation of NJE Option settings is not required. Expected Results: VALIDATE INCOMING JOBS (IN) = YES VALIDATE OUTGOING JOBS (OUT) = YES INHERITANCE ALLOWED (IN) = YES SEND ENCRYPTED PASSWORD (OUT) = YES DEFAULT LOGONID = NONELProcedures: Review the NOTIFY setting under  SYSTEM PARAMETERS IN EFFECT ;  OTHER section of ACF2 GSO Control Options. (NOTIFY denotes whether or not information displayed about the user s last login date and time will verify that unauthorized user of their logonid has not occurred since the user s last authentic logon session.) StatusPassFailInfoNot ApplicableBlank (Not Reviewed)Total Tests PerformedAbsolute Total # Tests Percent (%)Number of Checks 0.3 (cont.)Version Release DateSummary of ChangesName First ReleaseDUpdated warning banner language based on the IRS.gov warning banner.XPolicies and training are in place to ensure that users protect passwords appropriately.Policies and training are in place to ensure that users understand that passwords will not be automated or stored in clear text on the system.YDefault passwords for installed products are changed as part of the installation process.jProcedures: Review the  RESTRICTED PROGRAM NAMES section of the CA-ACF2 Control Options (GSO Record). Expected Results: Ensure the following sensitive programs are listed: (1) IEHINIT**** (2) FDR*** (3) DRWD**** (4) ICKDSF** (5) IEHD**** (6) *MASPZAP (7) DITTOProcedures: Review the  MAINTENANCE LOGONIDS/PROGRAMS/ LIBRARIES (MAINT record) section of the CA-ACF2 Control Options (GSO Record). Expected Results: Verify with appropriate systems personnel that: - All entries in the table are used for DASD maintenance or other related functions. - All program entries in the table are (1) exclusively maintained in ACF2-protected libraries, and (2) are accessible by authorized logonid(s) to perform activities commensurate with the existing user job function (e.g. DASD management)***. - All program entries are included in the  LOGGED PROGRAMS section of the CA-ACF2 Control Options (GSO Record).Procedures: Review the  TAPE BYPASS LABEL PROGRAMS/LIBRARIES (BLPPGM Record) section of the CA-ACF2 Control Options (GSO Record). Expected Results: Interview appropriate system personnel and evaluate the justification for authorizing tape BLP capabilities for all programs specified. Procedures: Review the NOSORT setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (NOSORT=NO denotes that access rule sets are sorted in order of most specific rules to most general rules. This ensures rule entries are executed in sequence specified in the rule set.) Procedures: Review the TAPE DSN setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (TAPE DSN denotes whether or not tape dataset protection is enforced before granting access. Tape dataset protection is enforced only if (a) setting = YES; and (b) Tape Management System (e.g. CA-1, TLMS) is in use. If setting is NO, only tape datasets defined to SECVOLS will have their access rules enforced.) Procedures: Review the  DSNAME PROTECTED VOLUMES -- setting under  RULES/DIRECTORY RESIDENCY OPTIONS section of ACF2 GSO Control Options. Expected Results: Since RESVOLS, SECVOLS, and TAPE DSN configurations function collaboratively to protect DASD and tape volumes, the following configurations provide adequate protection: (1) Optimal Solution = RESVOLS  ****** , SECVOLS has no masking compositions or naming patterns defined, and TAPE DSN = YES. (2) RESVOLS and SECVOLS =  ****** and TAPE DSN = YES or NO. (3) RESVOLS =  ****** , SECVOLS wi< th any setting, and TAPE DSN = YES.Procedures: Review the  VOLSER PROTECTED VOLUMES -- setting under  RULES/DIRECTORY RESIDENCY OPTIONS section of ACF2 GSO Control Options. Expected Results: Since RESVOLS, SECVOLS, and TAPE DSN configurations function collaboratively to protect DASD and tape volumes, the following configurations should provide adequate protection: (1) Optimal Solution: RESVOLS  ****** , SECVOLS has no masking compositions or naming patterns defined, and TAPE DSN = YES. (2) Alternative: RESVOLS and SECVOLS =  ****** and TAPE DSN = YES or NO. (3) Alternative: RESVOLS =  ****** , SECVOLS with any setting, and TAPE DSN = YES.Pass / Fail / N/AMReviewer to indicate if the test case passed, failed, or is not applicable. Procedures: Review the UID setting under  RULES/DIRECTORY RESIDENCY OPTIONS section of ACF2 GSO Control Options. (UID denotes a string of concatenated fields that controls the definition of each user s UID record. The string composition is derived from the existing Field Definition Record (FDR). Each field should be reviewed to determine which users can alter (ALTER=) specific fields in the string - - thereby potentially altering access authorities granted to users. ) 2Expected Results: Consequently, UID string alterations should be restricted to users with unscoped SECURITY or AUDIT attributes. Furthermore, the RESTRICT attribute should be used in conjunction with SECURITY or AUDIT with each of the field definitions specified in the UID string. SECURITY or AUDIT.***Procedures: Review the  ACF2 INTERCEPTS THAT HAVE RECEIVED CONTROL . Evaluate the appropriateness for each intercept that has not received control as specified by the (NO) setting. OAudit trails are generated for READ and above access attempts to FTI data sets.+Access to FTI data sets is properly logged.Interview the IAM, SA, and Network Systems personnel. Determine what capabilities the system has to detect and prevent inbound and/or outbound flooding-based denial of service attacksInterview the IAM, SA, and Network Systems personnel. Determine what capabilities the system has to prevent network session hijackingProcedures: Using the LIST IF command or the SL report, document who has the SECURITY or the ACCOUNT privilege. Inquire of appropriate personnel the justification for each user assigned these privileges. -SECURITY attribute allows: (1) access all datasets, protected programs and resources; (2) maintain all records in the Infostorage database; and (3) change and display logonid records. -ACCOUNT- The ACCOUNT attribute permits users to insert, catalog, and delete logonids (unless restricted or  scoped by the SCPLST logonid field). Users with the ACCOUNT attribute only, cannot catalog or change logonid records for users with both the ACCOUNT and SECURITY attributes. Expected Results: SECURITY and ACCOUNT privileges have been granted to a limited number of users with a security responsibility.Procedures: Using the LIST IF command or the SL report, determine who has the NON-CNCL privilege. Inquire of appropriate personnel the justification for each user or login ID assigned this privilege. The NON-CNCL attribute specifies ACF2 cannot terminate or  cancel a user s request to access a dataset to which the user is not explicitly authorized through an access rule set. However, ACF2 logs all uses of NON-CNCL authority. Expected Results: No more than 3 or 4 such users should be found, and these should be used for emergency purposes (e.g. started task IDs, assigned to FIRECALL IDs) only. In addition, their usage should be reviewed.KProcedures: Using the LIST IF command or the SL report, determine who has the READALL privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (READALL grants the user the authority to open any file for READ and EXEC regardless of the rules and only applies to datasets.) mExpected Results: The READALL privilege should be limited to security Started Tasks and Emergency logonids.wProcedures: Using the LIST IF command or the SL report, determine who has the AUDIT privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (AUDIT grants the user the authority to display logonid records, access rules, resource rules, and Infostorage records (e.g. GSO record), and all ACF2 system control options.) oExpected Results: The AUDIT privilege should be restricted to security auditors and/or security administratorsvProcedures: Using the LIST IF command or the SL report, determine who has the MAINT privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (MAINT grants the user the authority to execute any program defined in the MAINT GSO;  MAINTENANCE LOGINIDS/PROGRAMS/LIBRARIES . Without logging or access rule verification.) Expected Results: Only maintenance jobs having a business need to manage/maintain the logonids, programs, or libraries listed in the MAINT GSO section should be assigned this privilege. 0Procedures: Using the LIST IF command or the SL report, determine who has the TAPE-BLP privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (The TAPE-BLP attribute permits users to bypass label processing (BLP) when accessing tape datasets.) < Expected Results: Limited access should be granted to this privilege and restricted to personnel routinely tasked with performing tape management job functions.Procedures: Using the LIST IF command or the SL report, determine who has the ALLCMDS privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (The ALLCMDS attribute permits users to circumvent the ACF2 restricted command list.) Expected Results: Limited access should be granted to this privilege and restricted to personnel routinely tasked with performing job functions requiring use of ALLCMDS privilege. Evaluate delegation of this privilege for reasonableness. Procedures: Using the LIST IF command or the SL report, determine who has the REFRESH privilege. Inquire of appropriate personnel the justification for each user or Login ID assigned this privilege. (The REFRESH attribute permits users to issue the ACF2 REFRESH operator command from the operator console. Consequently, users can apply dynamic changes to records (e.g., GSO record) maintained in the Infostorage database.) Expected Results: Limited access should be granted to this privilege and should be restricted users (e.g., security administrators) routinely tasked with applying changes to records (e.g. GSO record) maintained in the Infostorage database.jProcedures: LIST each logonid record that has the SECURITY privilege and verify that the RULE-VLD attribute is present. (The RULEVLD attribute denotes all user access (in particular, access by data owners and users with the SECURITY attribute) to datasets and resources must be explicitly permitted by the access rules established for the dataset or resource.) |Expected Results: The RULEVLD attribute should be included in the logonid record for logonids with the SECURITY attribute.}Only systems programmers tasked with routinely maintaining the ACF2 system product have ALLOCATE authority to these datasets.Users have access as appropriate and based on need to know and the least privilege concept. FIRECALL or EMERGENCY IDs are the control used to grant temporary access to FTI datasets.Procedures: Obtain the Access Rules (report) from the security officer for each of the critical SYS1 datasets: -SYS1.PROCLIB -SYS1.LINKLIB -SYS1.LPALIB -SYS1.MIGLIB -SYS1.PARMLIB -SYS1.SVCLIB -SYS1.UADS -SYS1.VTAMLIB -SYS1.VTAMLST -SYS1.NUCLEUS Through inquiry of the security officer, determine the name and job function of each user listed separately or within a Group on the Access Control List. Determine whether users having ALLOC authority have a need for this level of access. YExpected Results: Only systems programmers should have ALLOC authority to these datasets.Procedures: Obtain the Access Rules (report) from the security officer for each ACF2 security database (including backups) using the high level prefix: SYS1.ACF* or applicable high-level prefixes for the following datasets/libraries: -SYS1.ACF2.RULES -SYS1.ACF2.LOGINIGS -SYS1.ACF2.INFOSTG -SYS1.ACF.BKLIDS -SYS1.ACF.BKRULES -SYS1.ACF.BKINFO Through inquiry of the security officer, determine the name and job function of each user listed separately or within a Group on the Access Control List. Expected Results: NO users should have ALLOC or WRITE access to these databases. (Note: Access to these databases can be granted via emergency purposes using a FIRECALL or EMERGENCY ID).=Procedures: All exits are properly justified and documented.Procedures: Review the -- AUTOMATIC ERASE VOLUMES -- setting under  OPTIONS IN EFFECT section of ACF2 GSO Control Options. (AUTOERAS denotes the type of datasets and volumes where physical erasure is performed during deletion (scratch).) Expected Results: Volume name(s) specified for FTI datasets and/or a naming pattern/masking composition that represents FTI dataset name(s).OAccess to the SMF data sets (SYS1.MANx) is restricted to authorized personnel. zThe system shows a IRS-approved screen-warning banner that outlines the consequences /penalties for misusing the system. CProcedures: Obtain a network diagram that depicts all access points used to process, store and transmit FTI  noting firewalls, routers, and switches where applicable. Determine if IP traffic (TN3270 terminal emulation sessions used to access application functions that process FTI, FTI file uploads/downloads) containing FTI is encrypted when traversing communication lines (e.g. T1, T3, ISDN) using encryption solutions including, but not limited to: Triple DES, SSL, TLS, or Secure IP Tunneling (VPN using IPSEC). Evaluate viable encryption alternatives for appropriateness.Users are prohibited from changing their passwords for at least 15 days after a recent change. Meaning, the minimum password age limit shall be 15 days after a recent password change. Note: Programs that should be maintained as  RESTRICTED PROGRAMS NAMES (PPGM record) are those programs that do not initiate standard system services (e.g. open SVCs). Consequently, these programs can circumvent ACF2 / SAF intercept points and compromise system security. Placing the aforementioned programs on the  RESTRICTED PROGRAM NAMES list restricts the use and delegation of such programs to users with the PPGM, NON-CNCL, or unscoped SECURITY attribute. Note: Programs specified in PPGM should be stored in CA-ACF2-protected libraries (e.g. *MASPZAP is stored in SYS1.MIGLIB) to prohibit unauthorized users from (a) reading and copying these programs into unsecured libraries; and (b) executing the copied programs under an uncontrolled name (i.e., not included on PPGM list). LNote: The logonids specified in these program entries are required to have the NON-CNCL or the MAINT attribute to ensure proper program execution. Consequently, these logonids allow users to execute these programs and circumvent explicit access rules (i.e., dataset authorization checking) and logging/auditing facilities specified for libraries that store these programs. Therefore, to mitigate the risk of unauthorized activities occurring without detection, th< e aforementioned entries should be specified under the  LOGGED PROGRAMS section of the ACF2 Control Options (GSO Record).Note: The GSO BLPPGM record grants a program the authority to use tape bypass label processing (BLP). This option is enforced at the program level  whether or not BLP authority is provided to users. In addition, the BLPLOG field, specified as  TAPE BLP section of CA-ACF2 GSO Control Options, logs all uses of BLP (i.e., TAPE BLP = LOG)  either by (a) a program authorized in the GSO BLPPGM record; or (b) a user authorized through the TAPE-BLP or TAPE-LBL attribute specified on the user s logonid record.Note: If NOSORT=YES and a $NOSORT statement is specified in an access rule set, ACF2 sorting of rules from most specific to most general is suppressed. Consequently, general rules placed before specific rules could inadvertently supersede the specific rules appearing later on in the access rule set. Therefore, a setting of YES should be justified by and discussed with the data owner or security administrator responsible for the rule set.To ensure optimal protection of tape and DASD datasets, RESVOLS, SECVOLS, and TAPE DSN configuration should be evaluated collaboratively to determine the residual or collective impact of dataset protection enforced by CA-ACF2 access rules. Test IDTest ObjectiveComments/Supporting EvidenceExpected ResultsActual Results>Procedures: 1. Request the System Administrator to generate an ACF2 data set access report for FTI data sets. 2. Review the report and verify that access to the FTI data sets is properly logged, and is restricted to authorized personnel. Using the previously obtained list of users authorized to access FTI data sets, verify that: a. Users logged as accessing FTI data sets are on the list of authorized users; b. No accesses to FTI data sets are logged for users not on the list; c. Logging records include READ accesses, as well as Write/Allocate accesses. 7Determine if ACF2 is used for TSO user logon validationConfer with the IAM and SA. Verify that interactive sessions (TSO, TPX, etc.) are locked after a period of inactivity in accordance with IRS guidelines. The inactivity time should be 15 minutes or less.Confer with the IAM and SA. Verify that interactive sessions (TSO, TPX, SSH, etc.) are terminated after a period of inactivity in accordance with IRS guidelines.The organization supervises and reviews the activities of users with respect to the enforcement and usage of information system access controls. (1) The organization employs automated mechanisms to facilitate the review of user activities.SCSEM Results Dashboard Test MethodExamine InterviewOut-of-Scope ReasonRA-1RA-2RA-3RA-5PL-1PL-2PL-4PL-5,Control not selected in IRS Publication 1075PL-6SA-1SA-2SA-3SA-4SA-5SA-6SA-7SA-9CA-1CA-2CA-3CA-5CA-6CA-7PS-1PS-2PS-3PS-4PS-5PS-6PS-7PS-8CP-1CP-2CP-3CP-4CP-6CP-7CP-8CP-9CP-10CM-1CM-8MA-1MA-2MA-3MA-4MA-5MP-1Control covered in the SDSEMMP-2MP-3MP-4MP-5MP-6PE-1PE-2PE-3PE-4PE-5PE-6PE-7PE-8PE-9PE-10PE-11PE-12PE-13PE-14PE-15PE-16PE-17PE-18SI-1SI-3SI-4SI-5SI-8IR-1IR-2IR-3IR-4IR-5IR-6IR-7AT-1AT-2AT-3AT-4IA-1AC-1AC-17AC-19AC-20AU-1SC-1SC-12SC-15SC-17SC-18SC-19SC-20SC-22 References+IRS Publication 1075, October 2007 Revision Control covered in the MOT SCSEMThe information system prevents further access to the system by initiating a session lock after 15 minutes of inactivity, and the session lock remains in effect until the user reestablishes access using appropriate identification and authentication procedures.?Interactive sessions are locked after 15 minutes of inactivity.CInteractive sessions are terminated after 15 minutes of inactivity.The information system automatically terminates a remote session after 15 minutes of inactivity. (1) Automatic session termination applies to local and remote sessions. First M. Lastmonth d, yyyy - month d, yyyyCity, STAgency POC(s): Name: Telephone # Email Address(###) ###-#### x#####First.M.Last@xx.xxx NIST ControlAssessment ObjectAuditable EventsAccess EnforcementLeast Privilege&User Identification And AuthenticationUnsuccessful Login AttemptsAuthenticator ManagementAccount ManagementAuthenticator FeedbackSystem Use NotificationSeparation Of DutiesInformation Remnance Session Lock Remote AccessAudit Storage Capacity%Response To Audit Processing Failures%Audit Reduction And Report Generation Time StampsProtection Of Audit InformationAudit Record RetentionIdentifier ManagementApplication PartitioningDenial Of Service ProtectionSession AuthenticityTransmission ConfidentialityControl Options (GSO Record)AU-2AC-3AC-6IA-2AC-7IA-5AC-2IA-6AC-8AC-5SC-4AC-11AU-4AU-5AU-7AU-8AU-9AU-11IA-4SC-2SC-5SC-23AU-6CM-2CM-3CM-4CM-5CM-6CM-7IA-7MP-7SA-8SA-10SA-11SC-7SI-2SI-9SI-10SI-11SI-12Flaw RemediationInterview ExamineProcedures: 1. Interview the administrator verify the process and procedures for receiving security patches and updating vulnerable systems. 2. Examine the system patch level and verify it is compliant with the currently released patch level by the vendor.A process and procedures are in place to identify patches and patch vulnerable systems. The system patch level is compliant with the current vendor patch level.Pass / Fail / N/A / InfoDIRECTIONS FOR SCSEM USEThis SCSEM is used by the IRS Office of Safeguards to evaluate compliance with IRS Publication 1075 for agencies that have implemented Access Control Facility (ACF2) software for a mainframe that receives, stores or processes Federal Tax Information (FTI). Agencies should use this SCSEM to prepare for an upcoming Safeguard review, but it is also an effective tool for agencies to use as part of internal periodic security assessments or internal inspections to ensure continued compliance in the years when a Safeguard review is not scheduled. Also the agency can use the SCSEM to identify the types of policies to have in place to ensure continued compliance with IRS Publication 1075.Last test case row:Number of test cases Control IDAC-21!Control not selected in Pub. 1075AC-22AU-13AU-14CM-9IA-8IR-8*Control covered in the MOT SCSEM and SDSEMPM-1PM-10PM-11PM-2PM-3PM-4Control covered in MOT SDSEMPM-5PM-6PM-7PM-8PM-9SA-12SA-13SA-14SC-16SC-25SC-26SC-27SC-28SC-29SC-30SC-31SC-32SC-33SC-34SI-13SI-7%Audit Review, Analysis, and ReportingNetwork DisconnectSC-10AU-12Audit Generation )Checks to see if auditing is implemented.uConfer with the IAM and SA. Verify that auditing is enabled. If the auditing is not enabled then this is a finding.Auditing is implemented.[Note: Auditing is enabled by default in ACF2, and cannot be turned off within the product.Procedures: Review the ACF2 COMMON setting under  SYSTEM PARAMETERS IN EFFECT ;  SMF RECORD NUMBERS s< ection of ACF2 GSO Control Options. Verify that all ACF2 SMF record types are assigned an SMF record number.Expected Results: All ACF2 SMF record types should be assigned an SMF record number. The following are commonly used ACF2 SMF record numbers. PASSWORD=220 DATASET VIO=221 LID JOURNAL=222 RULE JOURNAL=223 LID TRACE=224 TSO COMMAND=225 INFO JOURNAL=226 RESOURCE VIO=227 ACF2 COMMON=230<All ACF2 SMF record types are assigned an SMF record number.SYS1.PARMLIB(SMFPRMxx)}1. IBM (00-127), all ACF2 SMF record types (as defined in the ACFFDR, default 230), and TSOMON (199) SMF record types are written. . 2. Documentation exists for any record types appearing in a NOTYPE(nn) parameter. 3. If SMF exits IEFU83, IEFU84, IEFU85 are listed, they do not suppress required SMF record types. 4. The system SMF data sets (SYS1.MANx) exist and are written to. 8Identification and Authentication (Organizational Users) Determine in which library (SYS1.LINKLIB, etc.) the system audit data reporting tools reside. Obtain an access rules report for this library. Identify personnel who have access to the files and utilities. Ensure that no personnel have excessive access permissions.OAccess to the audit reporting tools is restricted to the appropriate personnel."Expected Results: PSWD ALTER=YES/Expected Results: PSWD WARN DAYS= [5-14 days]$Expected Results: MIN PSWD LENGTH=8Expected Results: PSWD-LID=YES#Expected Results: PSWD NUMERIC=YESExpected Results: PSWD HISTORY=YES [forces password history of 4] EXTENDED PASSWORD HISTORY=ACTIVE [forces extended password history] EXTENDED PASSWORD HISTORY #=2 (or more) [specifies number of extra stored - 4+2=6]xExpected Results: REQ ALPHBET CHAR=YES [forces at least one alpha] REQ NUMERIC CHAR=YES [forces at least 1 numeric] %Expected Results: REPEAT PAIR CHAR=0xProcedures: Review the REPEAT PAIR CHAR setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options. Procedures: Review the PSWD RESERVE WORD setting under  PASSWORD OPTIONS IN EFFECT section of ACF2 GSO Control Options, and the entries listed in the RESERVED WORD PREFIX LIST for common acronyms, prefixes, software system names, abbreviations, company names, etc. Expected Results: PSWD RESERVE WORD=YES RESERVED WORD PREFIX LIST contains common acronyms, prefixes, software system names, abbreviations, company names, etc.!Expected Results: PSWD FORCE=YES@Procedures: Review the QUICK LOGON setting under  TSO RELATED DEFAULTS ACTIVE section of ACF2 GSO Control Options. (QUICK LOGON denotes whether or not users can enter their passwords and logonids on the same line. YES indicates the password value will not be masked and will be displayed in plain text when entered.) "Expected Results: QUICK LOGON=NObProcedures: Review the LOGON WAIT TIME setting under  TSO RELATED DEFAULTS ACTIVE section of ACF2 GSO Control Options. (LOGON WAIT TIME denotes the number of seconds used by ACF2 to time user responses and to subsequently abort the logon if the wait time parameter is exceeded. Settings exceeding 120 seconds should be evaluated for appropriateness.) 5Expected Results: LOGON WAIT TIME= [60-120 seconds] Expected Results: TAPE BLP=LOG$Expected Results: MAX VIO PER JOB=3Expected Results: NOSORT=NOExpected Results: TAPE DSN=YES or alternatively - Option DSNAME PROTECTED VOLUMES and VOLSER PROTECTED VOLUMES (note this is referencing SECVOL) contain the entry  ****** and TAPE DSN = YES or NO.Expected Results: At a minimum, the following ACF2 intercepts should receive control: DASD-OPEN (YES) JOB INIT (YES) PROGRAM-CALL (YES) TSO-MVS (YES)>SUBSYS parameter is  ACF2 Note: Some may specify SUBSYS=****Expected Results: STC OPTION=ON (STC OPTION=OFF denotes that ACF2 will not authenticate access request initiated by a system/started task, regardless of the access rules established for the specific system resource.)Procedures: Review the MODE setting specified in the CA-ACF2 Control Options (GSO Record). This will be the first line of the SHOW ALL output. MODE=ABORT denotes ACF2 denies access to a dataset unless explicitly defined/permitted by the dataset access rule. All access violations are logged. MODE= LOG denotes ACF2 permits all access attempts to datasets, regardless of the dataset access rules. All access violations are logged. MODE=QUIET denotes ACF2 permits all access attempts to datasets, regardless of the dataset access rules. However, access violations are not logged. MODE=WARN denotes ACF2 permits all access attempts to datasets, regardless of the dataset access rules. All access violations are logged and an access-violation message is sent to user s terminal. MODE=RULE is deemed a selective mode, where conditional actions can be executed if the existing access rule does not permit the user s request to access to dataset.!Expected Results: MODE = ABORT 9Expected Results: INFO LIST AUTHORITY = SECURITY, AUDIT7Expected Results: DECOMP AUTHORITY = SECURITY, AUDITWProcedures: Review the INFO LIST AUTHORITY setting of the ACF2 GSO Control Options. (denotes the logonid attributes authorized to display the records (e.g. GSO records, resource rules, scope records, entry records) stored in the Infostorage database. Also, scoped users can list all Infostorage database records, except for resource rules.) Procedures: Review the DECOMP AUTHORITY setting of the ACF2 GSO Control Options. (denotes the types of users authorized to decompile (but not alter) and display access/resource rules regardless of restrictions placed by scope records.) 'Expected Results: LOGON RETRY COUNT=3Expected Results: PSWD-JES=ON'Expected Results: MAX PSWD ATTEMPTS=3!Expected Results: JOB CHECK=YESExpected Results: UADS=BYPASS%Expected Results: PSWD REQUIRED=YESExpected Results: NOTIFY=YESProcedures: Review SYS< 1.PARMLIB(SMFPRMxx) [xx=00 or production suffix) 1. Ensure that, at a minimum, all IBM (00-127), all ACF2 SMF record types (as defined in the ACFFDR, default 230), and TSOMON (199) SMF record types are written. 2. Request documentation for any record types appearing in a NOTYPE(nn) parameter. Note: Some records, such as (NOTYPE(4:5,16,19:20,34:36,40:41,69,99), may be suppressed for performance reasons. 3. If SMF exits IEFU83, IEFU84, IEFU85 are listed, verify with the Systems Programmer the functions performed by the exits. Ensure that they do not suppress required SMF record types. 4. Verify that the system SMF data sets specified in DSNAME(SYS1.MANx,...) exist and are written to. Check to see if the feedback from the information system provides information that would allow an unauthorized user to compromise the authentication mechanism. Displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.Interview ISSO or SA and ask if any applications or services display the user or service account password during input or after authentication. Note: The TSOTWX and TSO2741 settings are no longer listed in the ACF2 GSO Control Options.Checks to see if the information system employs authentication methods that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.eInterview the SA or ISSO to determine if FIPS 140-2 encryption is used for the authentication module.XThe authentication module is encrypted with a FIPS 140-2 compliant cryptographic module.bNote: Use of the IBM Integrated Cryptographic Service Facility (ICSF) satisfies this requirement.zThe site should have adequate procedures in place for initial password dissemination, and forces periodic password change.HExpected Results: The warning banner is compliant with IRS guidelines and contains the following 4 elements: - the system contains US government information - users actions are monitored and audited - unauthorized use of the system is prohibited - unauthorized use of the system is subject to criminal and civil penalties jNIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems, Revision 3Booz Allen Hamilton#DESCRIPTION OF SYSTEM ROLE WITH FTInProvide a narrative description of this system's role with receiving, processing, storing or transmitting FTI.System Hostname:[The dashboard is provided to automatically calculate test results from the Test Case tab. The 'Info' status is provided for use by the reviewer during test execution to indicate more information is needed to complete the test. It is not an acceptable final test status, all test cases should be Pass, Fail or N/A at the conclusion of the review.`Privileged personnel should not use the same logon IDs for both normal and privileged functions.NChecks to ensure the system is current with vendor released security patches.7Procedures: 1. Obtain the Access Rules (report) from the security officer for ACF2 distribution libraries (generally denoted by the high level prefix CAI.*) 2. The ACF2 distribution libraries contain the load modules for the ACF2 software product. Examples of ACF2 load modules include the ISPF (Interactive System Productivity Facility) interface panels, macros, or vendor-developed JCL (Job Control Language) procedures. 3. Through inquiry of the security officer, determine the name and job function of each user listed separately or within a Group on the Access Control List. Determine whether users having access is appropriate and based on a need to know, least privilege concept. Only systems programmers tasked with routinely maintaining the ACF2 system product should have ALLOCATE authority to these datasets.Confer with the Systems Programmer and IAM to determine the site policy and procedures for dumping (backing up) SMF data and creating duplicate backups to prevent data loss. Determine that the site data retention policy is in accordance with IRS guidelines.uAppropriate console alerts are issued, and procedures exist to notify personnel and to manage the backup of SMF data.Confer with the IAM to determine the site policy and procedures for issuing, managing, revoking, and archiving user access credentials. Determine whether or not logon IDs are re-issued after they have been used.wPasswords must contain alphanumeric characters, with a minimum of one (1) numeric character or (1) special character. Confer with the IAM to determine the site policy and procedures for issuing and disseminating initial user passwords, and for requiring and enforcing periodic system-wide password change.#Cryptographic Module AuthenticationNote: Remote access is defined as any access to an agency information system by a user communicating through an external network, for example: the Internet. All FTI data in transit is encrypted when moving across a Wide Area Network (WAN) and within the agency s Local Area Network (LAN). SC-8 SC-9IP traffic (TN3270 terminal emulation sessions used to access application functions that process FTI, FTI file uploads/downloads) containing FTI is encrypted when traversing communication lines (e.g. T1, T3, ISDN) using FIPS 140-2 approved encryption solutions.XUpdated SCSEM based on NIST 800-53 rev3 release Updated for new Publication 1075 version" Updates: -Cover: Reorganized the Tester and Agency POC information cells, to better reflect possible multiple POCs. -Test Cases: a. Changed Column G header to "Pass / Fail / N/A", to more accurately reflect the four possible status indicators. Updated column headings to be consistent across all the Technical SCSEMs. b. Added conditional formatting to the status cells, and included summary cells at the bottom of the checks. c. Added control names to the NIST ID cells. Primary control is listed in black; any secondary controls are listed in GRAY. d. Changed the primary control for several findings where there was a better fit than the currently assigned control -Legend: Updated the Pass/Fail row to reflect the three possible status indicators (above). -Test IDs:  !u!!!< Updates: -Cover: Added SCSEM disclaimer language -Dashboard: Added test case calculations -Test Cases: a. Updated NIST test case method on old to new test cases b. Added test method column -Out of Scope Controls: Newly added worksheet to identify out of scope controls -Sources: Added worksheet for source documents  1 <Z g  eSafeguard Computer Security Evaluation Matrix (SCSEM) CA-ACF2 Release IV July 30, 2010 Version 0.5)K*The IRS strongly recommends agencies test all SCSEM settings in a development/test environment prior to deploying them in operational environments because in some cases a security setting may impact a system s functionality and usability. Consequently, it is important to perform testing to determine the impact on system security, functionality, and usability. Ideally, the test system configuration should match the operational system configuration. Prior to making changes to the production system agencies should back up all critical< data files on the system and if possible, make a full backup of the system to ensure it can be restored to its pre-SCSEM state if necessary. The IRS welcomes feedback and suggestions from agencies in regard to individual SCSEMs.*$ & PBO[  ] >/N$;,+ +E -F;IX ZV_go2j $A \y  ,Id %Be֏.Vs.Wt5Zw͖"@]Vs2Oqϭ 81s  k@ccB  +  dMbP?_*+%&ffffff?'ffffff?(?)?MFreedom Import Printer$C od,,LetterDINU"CSMTJFreedom Import PrinterInputBinAUTORESDLLUniresDLLOrientationPORTRAITResolutionOption5PaperSizeA4PrintQualityLETTER_QUALITYColorModeColorTFSM"d,,333333?333333?&<3U} $ } } $ }  } I} } $ +                           @  &                     '       0l*2# $ % & ' ( *  # #V $ $W % %X &Y &Z& &[& & \ 'V '] ' b^ (V (] ( b^ *xL**|(   %O2 S N Group 2Horizontal Rule"x ] `~vB B >?Line 3%O]`@4|B  D)?Line 4Z 22]`4  JA 1?IRS Logop!]N` 7  $<Word.Document.8>@ 7"7    '' yK First.M.Last@xx.xxxyK Nmailto:First.M.Last@xx.xxxyX;H,]ą'c(( yK First.M.Last@xx.xxxyK Nmailto:First.M.Last@xx.xxxyX;H,]ą'cggD    dMbP?_*+%&ffffff?'ffffff?(?)?MFreedom Import Printer$C odXXLetterDINU"CSMTJFreedom Import PrinterInputBinAUTORESDLLUniresDLLOrientationPORTRAITResolutionOption5PaperSizeA4PrintQualityLETTER_QUALITYColorModeColorTFSM"dXX333333?333333?&<3U} } I}     @             fgggggggggggh  fgggggggggggh  ggggggggggggg    @0$0$0$0$$$$$$>@"   ggD  VH  dMbP?_*+%&ffffff?'ffffff?(?)?MHP LaserJet 4P4C odXXLetterDINU"4z=      !"#$%&'()*+,-./0123456789:;<=>?"333333?333333?&<3U} } } I J  000000 0 0 0 @    j k j V+X ;S PassAZ.W #DD B V+X ;S FailAZ.W #DD B V+X ;S InfoAZ.W #DD B i*X ;S N/AAZ.W #DD B V$VT@ ;S A[.W? #DD B V# Y  % V V# YT@  % V l   T@  D .U@ ;@@B@"*ooonh?? 1>@ &   ;  @@B@B@4C@Pass;  @@B@B@4C@Fail;  @@B@B@4CInfo  ;  @@B@B@4C@Pass;  @@B@B@4C@Fail;  @@B@B@4CInfo  ;  @@B@B@4C@D{+{ {+{ {+{ {+{ {+{ {+{ {{ ;@@B@B@4C@3[ t| Sheet2ggD  ,^/DPTX\]  dMbP?_*+% &C&P of &N&?'?(?)?M \\ipp://156.80.61.26\i_A365_HP S oAXXLetterPRIV0''''T\KhC]F4TRJPHAA536406"AXX??&U} } I } }  } $} $} (} } $} I } $} $ } $ } $   y       R          c_ c# c c`  &    ~ z? vl v vv {R | |S.}~~ z@ vm vC vv { | | ~  ~ z@ zg z vv |C | |.~~ z@ zb z{ v ~y |g |. |.~~ z@ zb z{ v ~y |y |2 | ~ ~ z@ zb z{ v ~y |D | |.~~ z@ zb z{ v ~y H | | ~  ( ~ z @ vb v{ v ~y |L | | ~  ( ~ z"@ vb v{ v ~y |M | | ~ ( ~ z$@ vb v{ v ~y |N | |. ~~ z&@ vb v{ v ~y |O | |. ~~ z(@ vb v{ v ~y |T | |. ~~ z*@ vb v{ v ~y |U |V |. ~~ z,@ vb v{ v ~y |d |v | ~  w( ~ z.@ vj v vv |b | |.~~ z0@ zc z| v ~y |i |/ | ~ ~ z1@ zc z| v ~y |I | | ~  ( ~ z2@ vc v| v ~y J | | ~  ( ~ z3@ vc v| v ~y K | |.~~ z4@ vc v| v ~y |P | |.~~ z5@ vc v| v ~y |Q | |.~~ z6@ vc v| v ~y |R | |.~~ z7@ vc v| vv |W | | ~ ~ z8@ vc v| vv |X | | ~ ~ z9@ vc v| vv |Y | | ~ ~ z:@ vc v| vv |Z | | ~ ~ z;@ vc v| vv |[ | | ~ ~ z<@ vc v| vv |\ | | ~ ~ z=@ vc v| vv |] | | ~ ~ z>@ vc v| vv |^ | | ~ ~ z?@ vc v| vv |_ | | ~ D|l|||||||| !"#$8@%&'() *@+,@-@./012@3D@45 67 8 9:;<=>~ @?~ z@@ vc v| v v |`  | ~ ~ !z@@ !vc !v| !v!v !|a !|m !| !~ ~ "zA@ "vc "v| "v"v "|c "| "| "~ ~ #zA@ #ze #z~ #v #~y #|z #|4 #|.#~~ $zB@ $ze $z~ $v $~y $|} $|7 $|.$~~ %zB@ %ze %z~ %v %~y %| %|? %|.%~~ &zC@ &vi &v &v&v &| &|l &| &~ ~ 'zC@ 'vs 'v 'v'v '| ' '| '~ ~ (zD@ (v (z (v(v (| (| (| (~ ( ~ )zD@ )za )zz )~ )~y )f )- )0.)~~ *zE@ *za *zz *v *~y *|h *| *| *|,* ~~ +zE@ +za +zz +v+v +| +| +| +~ ~ ,zF@ ,za ,zz ,v ,v ,|k , ,|.,~~ -zF@ -vn -v -v-v -| -| -| -~ ~ .zG@ .vo .v .v.v .| .| . .~ ~ /zG@ /v /z /v/v /| /| /| /~ ~ 0zH@ 0p 0v 0v0v 0| 0| 0| 0~ ~ 1zH@ 1vq 1v 1v1v 1| 1| 1| 1~ ~ 2zI@ 2vr 2v 2v2v 2| 2| 2| 2~ ~ 3zI@ 3zr 3z 3v3v 3|G 3|j 3|.3~~ 4zJ@ 4zd 4z} 4v 4~y 4|x 4|1 4|.4~~ 5zJ@ 5z 5z} 5v 5~y 5| 5|3 5|.5~~ 6zK@ 6z 6z} 6v 6~y 6|{ 6|5 6|.6~~ 7zK@ 7z 7z} 7v 7~y 7|E 7| 7| 7~ ~ 8zL@ 8vt 8v 8v8v 8{ 8 8| 8~ ~ 9zL@ 9zf 9z 9v 9~y 9|| 9|6 9|.9~~ :zM@ :zf :z :v :~y :| :|8 :|.:~~ ;zM@ ;zf ;z ;v ;~y ;| ;|9 ;|.;~~ <zN@ <zf <z <v <~y <|~ <|: <|.<~~ =zN@ =zf =z =v =~y = =|; =|.=~~ >zO@ >zf >z >v >~y >|n >|< >|.>~~ ?zO@ ?zf ?z ?v ?~y ?| ?|= ?|.?~Dl|||||||||||||@Aa@BC @D EFGs@HI J0 @KL MNOPQ R S @~ @zP@ @zf @z @v @~y @|o @| @|.@~~ Az@P@ Azf Az Av A~y A| A| A|.A~~ BzP@ Bzf Bz Bv B~y B| B|> B|.B~}~ CzP@ Czf Cz CvCv C| C|@ C|A C~ ~ DzQ@ Dzf Dz DvDv D D|B D| D~ ~ Ez@Q@ Ezf Ez EvEv E|r E|s E| E~ ~ FzQ@ Fzf Fz FvFv F|t F|u F| F~ ~ GzQ@ Gzf Gz GvGv G|p G|q G| G~ ~ HzR@ Hf H HH H H H H ~ I@R@ Ih I II I I  I I ~ JzR@ Jvh Jv Jv J~y J|S J| J| J~ ~ KzR@ K K KK K  K  K  K  K ~ ~ LS@ L L L Ly LF L L L ~ Mz@S@ Mz Mz MvMv M{U M| M|T M}~ ~ NzS@ Nvu Nv NvNv N| N| N N~ ~ OzS@ Ovw Ov OvOv O O| O| O~ ~ PzT@ Pzk Pz Pv P~y P|e P| P|.P~~ Qz@T@ Qvv Qv QvQv Q Q| Q| Q~ ~ RzT@ Rzx R! RvRv R  R R" R~ ~ SzT@ Sz Sz SvSv S S| S| S~ , |||||||||||||a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~  a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~  BX                                                                 Dl                                                                 Dl             d &  (  R  C ]F!4 d ZR  C ]F!`4 d ZR  C ]F!4 d ZR  C ]F!4 d ZR  C ]F!@4 d ZR  C ]F!4 d ZR  C ]F!4 d ZR  C ]F! 4 d ZR   C  ]F !4 d ZR   C  ]F !`4 d ZR   C  ]F ! " d >@UP "ڠA wa ^a P ;@Pass;@Fail;InfoKK KK ;@Pass;@Fail;Info{+{a {+{a {+{a  {+{KK {+{KK {+{KK   Input Error5Please enter an accepted value: Pass, Fail, N/A, InfoPassFailN/AInfoN^` P  Sheet3ggD  $iGqxW5O  dMbP?_*+%&ffffff?'ffffff?(?)?"333333?333333?as&<3U} p} 8p} $ p      m no qB rQo qD rQo qE rQo s to s tQo d= eo d> eo q? rQo q@ rQ o qF rQ o d rQ o s t o s t o q rQo q rQo u rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo q rQo s tQo q rQo v woD@l&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& !"#$%&'()*+,-./0123456789:;<=>? q  rQ o !q  !w!o "q  "rQ"o #q  #rQ#o $d  $e$o %v %w%o &v &w&o 'qA 'rQ'o (q (rQ(o )s )t)o *d6 *e*o +d7 +e+o ,q8 ,rQ,o -d9 -e-o .d: .e.o /d; /e/o 0q< 0rQ0o 1s 1t1o 2q 2rQ2o 3q 3rQ3o 4q 4rQ4o 5q 5rQ5o 6q 6rQ6o 7v 7w7o 8v 8w8o 9v 9w9o :v :w:o ;v ;w;o <v <w<o =v =w=o >v >w>o ?v( ?w?oD@l&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_ @v) @w@o Av* AwAo Bv+ BwBo Cv, CwCo Dv- DwDo Ev. EwEo Fv/ FwFo Gv0 GwGo Hv  HwHo Iv! IwIo Jv" JwJo Kv# KwKo Lv$ LwLo Mv% MwMo Nv& NwNo Ov' OwOo Pq PrQPo Qq QrQQo Rq RrQRo Sq SrQSo Tq TrQTo Us UtUo Vs VtVo Ws WtWo Xs XtQXo Ys YtYo Zs ZtZo [s [t[o \s \t\o ]s ]t]o ^s ^t^o _s _t_oD@l&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&`abcdefghijklmnopqrstuvxwxxxyxzx{x|x}x~xx `d `e`o ad aeao bd bebo cd ceco dd dedo ed eeeo fd fefo gd gego hq hrQho id irQio jq jrQjo kq krQko lq lrQlo ms mtQmo nd nrQno os ot ps pt qs qt rq rrQ sq srQ tq trQ uq urQ vq vrQ wq wrQ xq xrQ yd ye zqG zrQ {qH {rQ |qI |rQ }s }t ~qJ ~rQ qK rQDl&&&&&&&&&&&&&&&xxxxxxxxxxxxxxxxxxxxxxxxx qL rQ qM w qN w s t s t s t s t s t s t s t s tQ s t s t q rQ q1 rQ q wQ q wQ d e s t q2 rQ q3 rQ q4 rQ s tQ q5 r q wQ 8>@A  Sheet4ggD  +I  dMbP?_*+%&ffffff?'ffffff?(?)?"333333?333333?&<3U} I_U} $ U \OZ ^Z ]Z _Z ]PZ[d>@UR Sheet5ggD   ܐ  dMbP?_*+%&?'?(?)?"??&U} C} M} 1B} m}B} B} mC} B} &D} IB} IE} AB} B} $ B ,X@X@@,I,@,@@ @ ,@ @ !  + FGGGB  H"J A# H$B  H%BB & H'BB  H(B B   H) B B   K B B *  L, B0&:::::>@LJ J   w Sheet6ggD  3  dMbP?_*+%&?'?(?)?M\\ipp://156.80.61.27\i_A585_HPS odXXLetterPRIV0''''\KhCם{SMTJHP LaserJet 9000 PSOutputBinUpperStapleLocation1parallelHPJobRetentionHPJobRetentionOffHPUserNameUserSystemHPJobHoldKey1HoldKey0000HPJobHoldKey2HoldKey000HPJobHoldKey3HoldKey00HPJobHoldKey4HoldKey0HPEdgeToEdgeTrueHPwmTextNoneHPwmNUPNoneHPwmFontHelveticaBHPwmFontSizept48HPwmTextAngleDeg45HPwmTextStyleMediumHPwmLocationTrueHPCollateTrueSmoothingTrueJCLResolution600dpiJCLFastResTrueJCLEconomodeFalsePageSizeLetterPageRegionLeadingEdgeInputSlotMiddleMediaTypeNoneHPPaperPolicyPromptUserHPHalftonePrinterDefaultDuplexNone"dXX??&U}  } m%} IF@       N N N NO$@P@@@ Q OO4@P@P@ Q OS>@Tt@ R$ O S T R O`D@a@ Q% OO?P@ # OOOQOOOQO OOQO OOQO OOQO OOQO OOQOOOQOOOQOOOQOOOQO(T8222822>@OJA w Sheet7ggD X 8Safeguard Computer Security Evaluation Matrix (SCSEM) IRSJonathan IsnerMicrosoft Excel@4@v)@Α7՜.+,D՜.+,h PXh px 'BA&H  CoverPurpose DashboardDocumentSummaryInformation8CompObj r Test CasesOut Of Scope ControlsSourcesLegend Change Log'Test Cases'!Print_Area  Worksheets Named Ranges$ 8@ _PID_HLINKSA kHmailto:First.M.Last@xx.xxxkHmailto:First.M.Last@xx.xxx F&Microsoft Office Excel 2003 WorksheetBiff8Excel.Sheet.89q