邢唷��>� >��;<=�� T8�衫��\pMichael Caruso B�a�= �ThisWorkbook��=xiL;�$8�@�"��1��Arial1��Calibri1��Calibri1��Calibri1��Arial1��Arial1��Arial1��Arial1��Arial1��Arial1��Arial1��Arial1��Arial1� �Calibri1�4�Calibri1� �Calibri1��Calibri1��Calibri1�>�颁补濒颈产谤颈1�4�颁补濒颈产谤颈1�<�Calibri1�?�Calibri1��Calibri1� �Calibri1��Calibri1,>�Calibri1>�Calibri1�>�Calibri1h>�Cambria1��Calibri1� �Calibri1��Calibri1�4�Calibri1� �Calibri1��Calibri1��Calibri1,8�Calibri18�Calibri1�8�Calibri1��Arial1�>�颁补濒颈产谤颈1�4�颁补濒颈产谤颈1�<�Calibri1�?�Calibri1h8�Cambria1��Calibri1� �Calibri1��Arial1�<�Arial1�<�Arial1� �Arial1 ��Segoe UI"$"#,##0_);$"$"#,##0$!"$"#,##0_);[Red]$"$"#,##0$""$"#,##0.00_);$"$"#,##0.00$'""$"#,##0.00_);[Red]$"$"#,##0.00$7*2_("$"* #,##0_);_("$"* $#,##0$;_("$"* "-"_);_(@_).))_(* #,##0_);_(* $#,##0$;_(* "-"_);_(@_)?,:_("$"* #,##0.00_);_("$"* $#,##0.00$;_("$"* "-"??_);_(@_)6+1_(* #,##0.00_);_(* $#,##0.00$;_(* "-"??_);_(@_)� m/d/yyyy;@,�'[<=9999999]###\-####;$###$\ ###\-####�0.0�� !� �� "� 攆f�� 攆f�� +� �� )� �� ,� �� *� �� #� �� $� �� %� �P� �� P@ @ � �&� �P� �� P� �'� � � �� @ @ � �'� �� (� �� )� �� *� �`� �� `� �+� �� ,� �� -� �� .� �a>� �� a@ � �/� �� @� � ? �� @ �� `@ � � ? @ � � � � `� � x� �x� � `�@ � � `�� h? ? � h? � � ` �? � ` �� `? ? � <�� 8�� 4!�� 0�� 4!!�� 8!�� 0!!�� 0� ��4�� 4? �� 0�� 4�� 8? �� 8�� x? �7 � x@ �7 � x��7 � x? � � x@ � � x�� 8 �@ � �x? ? � �x@ ? � �x�? � � x? @ � � x� � x�@ � � x@ �� x�� 8? @ � �8� �x� � � � P� � x? ? � � x@ ? � � x�? � � x? �� p? �, �x��, �x? �, �x@ �, �x��, �x? ? , �x@ ? , �x�? , � x? �, � x@ �, � x��, � x@ ? , � x�? , � x? �, � x@ �, �x��, �x��, �x!��, �p��, � x? ? , � x��, � �� 8@ ? � � <@ ? � �8� � <� � �@ ? , � ��? , � €� � �, � ��@ , � �, � ��@ , � �, � ��@ , � �? �, � �@ �, � ��, ��? ? ��@ ? ��? � �? @ �� @ ��? � ��@ � �� ? �7 ��@ �7 ��7 ��? �� 0�@ �� 0�� 0��@ �� 1�� 2�@ �� 2�� 2 �� ? �, ��@ �, ��, �0�@ �� 0�@ �� @ �� 0��@ �� 0��@ �� @ �, � �� (a €� � �� @ �7 � ��7 � �? @ � � �� @ � � �@ �� ? �7 ��? �, ��@ �, ��, � �� 2�@ ? � �2��? � �2 �� 2�� 2��@ � �3�@ �� 3�� ? ? ��@ ? ��? � �? ? � � �@ ? � � ��? � ��? � ��@ � �� ? �� ? � ��@ � �� ? �� @ �� ? @ �� @ ��, � � � ��? �0�@ �� 0��@ �� ? ? , � �? @ , �0 �? @ , � 8�� 4�� 4? �� 0�� 4�� 0�� 8�� 8�� ? �� ? �� 8�� ||)譛"w}A} )\ ###\-ef;_(@_) }A} )\ ###\-ef;_(@_) }A} )\ ###\-ef;_(@_) }A} )\ ###\-ef;_(@_) }A} )\ ###\-ef;_(@_) }A} )\ ###\-ef ;_(@_) }A} )\ ###\-蘈;_(@_) }A} )\ ###\-蘈;_(@_) }A} )\ ###\-蘈;_(@_) }A}" )\ ###\-蘈;_(@_) }A}$ )\ ###\-蘈;_(@_) }A}& )\ ###\-蘈 ;_(@_) }A}( )\ ###\-23;_(@_) }A}* )\ ###\-23;_(@_) }A}, )\ ###\-23;_(@_) }A}. )\ ###\-23;_(@_) }A}0 )\ ###\-23;_(@_) }A}2 )\ ###\-23 ;_(@_) }A}4 )\ ###\-;_(@_) }A}6 )\ ###\-;_(@_) }A}8 )\ ###\-;_(@_) }A}: )\ ###\-;_(@_) }A}< )\ ###\-;_(@_) }A}> )\ ###\- ;_(@_) }A}@ ��)\ ###\-�俏�;_(@_) }�}B 鷠�)\ ###\-蝌�;_(@_) � � � �}�}D )\ ###\-ゥ�;_(@_) ???� ???� ???� ???�}-}J �)\ ###\-}A}L a�)\ ###\-骑�;_(@_) }A}N )\ ###\-;_(@_) }A}P )\ ###\-�?;_(@_) }A}R )\ ###\-23;_(@_) }-}T )\ ###\-}(}V )\ ###\-}�}W ??v�)\ ###\-�虣�;_(@_) � � � �}A}Y 鷠�)\ ###\-�€�;_(@_) }A}[ 渆�)\ ###\-�霚�;_(@_) }x}`��)\ ###\-膊��霚�;_(膊�� 膊�� 膊��}�}b ???�)\ ###\-蝌�;_(???� ???� ???� ???�}-}e )\ ###\-}U}g )\ ###\-;_( }-}i ��)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}� )\ ###\-}(}� )\ ###\-}(}� )\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}� )\ ###\-}(}� )\ ###\-}(}� )\ ###\-}(}� )\ ###\-}(}���)\ ###\-}(}� )\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}���)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}� ��)\ ###\-}(}�膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(} 膊�)\ ###\-}(} 膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}膊�)\ ###\-}(}��)\ ###\-}(} )\ ###\-}(} )\ ###\-}(} )\ ###\-�9�+��€� !%�9� ��?333� !%�9�€�*�� !%�9�+�� !%�9�+�� !%�9�+�� !%� 20% - Accent1�M�� 20% - Accent1ef苕��%�20% - Accent1 2� 20% - Accent2�M�"� 20% - Accent2ef蜍��%�20% - Accent2 2� 20% - Accent3�M�&� 20% - Accent3ef腭��%�20% - Accent3 2� 20% - Accent4�M�*� 20% - Accent4ef溥��%�20% - Accent4 2� 20% - Accent5�M�.� 20% - Accent5ef陬��%�20% - Accent5 2� 20% - Accent6�M�2� 20% - Accent6 ef��%�20% - Accent6 2� 40% - Accent1�M�� 40% - Accent1蘈柑��%�40% - Accent1 2� 40% - Accent2�M�#� 40% - Accent2蘈娓��%�40% - Accent2 2� 40% - Accent3�M�'� 40% - Accent3蘈劁��%�!40% - Accent3 2�" 40% - Accent4�M�+� 40% - Accent4蘈汤��%�#40% - Accent4 2�$ 40% - Accent5�M�/� 40% - Accent5蘈忿��%�%40% - Accent5 2�& 40% - Accent6�M�3� 40% - Accent6 蘈��%�'40% - Accent6 2�( 60% - Accent1�M� � 60% - Accent123暢��%�)60% - Accent1 2�* 60% - Accent2�M�$� 60% - Accent223跂��%�+60% - Accent2 2�, 60% - Accent3�M�(� 60% - Accent323淖��%�-60% - Accent3 2�. 60% - Accent4�M�,� 60% - Accent423睜��%�/60% - Accent4 2�0 60% - Accent5�M�0� 60% - Accent523捦��%�160% - Accent5 2�2 60% - Accent6�M�4� 60% - Accent6 23��%�360% - Accent6 2�4Accent1�A��Accent1O伣��%�5 Accent1 2�6Accent2�A�!�Accent2繮M��%�7 Accent2 2�8Accent3�A�%�Accent3浕Y��%�9 Accent3 2�:Accent4�A�)�Accent4€d��%�; Accent4 2�<Accent5�A�-�Accent5K��%�= Accent5 2�>Accent6�A�1�Accent6 鳀F��%�? Accent6 2�@Bad�9��Bad��俏��%� ABad 2�BCalculation��Calculation�蝌��鷠�%�� C Calculation 2�D Check Cell�� Check Cell�ゥ��%�???��???��???� �???��ECheck Cell 2�F€�� Comma�G€��(�� Comma [0]�H€��&��Currency�I€��.��Currency [0]�JExplanatory Text�G�5�Explanatory Text��%�KExplanatory Text 2� LGood�;��Good�骑��a�%�MGood 2�N Heading 1�G�� Heading 1I}�%O伣��OHeading 1 2�P Heading 2�G�� Heading 2I}�%�?Э��QHeading 2 2�R Heading 3�G�� Heading 3I}�%23暢��SHeading 3 2�T Heading 4�9�� Heading 4I}�%�UHeading 4 2�V€��4�� Hyperlink �� WInput�u��Input��虣��??v�%�� XInput 2�YLinked Cell�K��Linked Cell�鷠�%��€��Z Linked Cell 2�[Neutral�A��Neutral��霚��渆�%�\ Neutral 2�€��"��Normal� ]Normal 2� ^Normal 3� _Normal 4� `Note�b� �Note��膊��膊��膊� �膊��aNote 2�bOutput�w��Output�蝌��???�%�???��???��???� �???�� cOutput 2�d€��$��Percent� eTitle�1��TitleI}�%�fTitle 2� gTotal�M��Total�%O伣�O伣��hTotal 2�iWarning Text�?��Warning Text��%�jWarning Text 2�X��TableStyleMedium2PivotStyleLight16`� Dashboard�E�Results�炢Instructions�!� Test Cases��8Appendix�H Change Log��&! ;W ; ; ;' ;! ; ;V ;��縎fVf餈� @��€€€�� 皈�0�5b�-!ODw�30@Gb姗� T�n�!ODw�30@Gb姗�塒NG IHDR��鷂:檄��痴浿尘*皑铁斋鲍�揹▇=鋛瓐顿冔角裷鮪坿扔测鮈=崠睊敎")))产�,黦别别%6谚忉�$镑.忭�(贰<湧b�"衽笀画1猂q�銎剫W�^滛宕c粀锕蜍V砜牏�髝U疦潑s~洺汫廱�>~f8x瘭箌G�=1�%1� 墘"�懜;KaL!w墸�8谫娊Z硒膁y枑(镶%,"ZB€�宖嶉吹徘�(儭笚�4猏J歏--� 8+x9垘|喉�o�=y蛟�w�O謬氵o1|栲WF�o机�9�雋4�椾dq鰌56┾k╓堡糚簶�8卺>�7J茹( })釕�'�つ$姯崟8衆�洆鰐�"\&�严渎蛖r9|)��4� �JS弁kW�MjJ誃v塭裹箌濯�>x網�?襞�3€踺譥T螂;亸� 帓叨3>�b'{Ｘ�j�-&隫桗K)喙鶻�軖�€[wBD86嶺巅妧捗�NOR挼鲹饙鱇�,"�*敂JK┞�縵[6煾,go苊矷F墠7x�,b诋仭~)w�-圄宋瓫f崫0�商a纩C穬c嗹wn荼際G痓o锟^r嵛撈犽w @?�"�</7�*璳T匥懀7e+600榟G�婁K/挏)ч萖蒵\�軮箁�`7╒F町匙d阊 �0�|藯0鰋[切糽�;�锿藁u3~�Y�+腧�#�#�熭圝给鄀�-N�J�*"輿謹茣}�&0益苗遴闺X搥��!拌%?餂��"�c6璣^^jR]J�緗K�8g糑kee熵邮)e莠�t矟T畓牴�_X课A蛕 ��垆椡㑇W籈-檐��f|遛觬鶭H�1�9&眲U扗繥�.爴LX“кD軮${朖�30� o"唯挙"珃瑟}`2怑蒞z惮-%�巼�;袅妊銕Yj�?褛`}旘碲wX�#餓胦�擥�墐粙胥>m e�捙籓�0缟q{He,H焳Hs$M^x痑�R⿲T雠�2u�Yu銪�:睅鳧Y:i狓_�#?�;� �耵憨C琉G�-硳C缾/s灪pC�nO� �5�� 掷獈`頮o]G飮蓷藇�"� ^偶d\爪叶妖{骶>纨瘿�?稽�栞諃硧軌�5~y瞿桎鈊鴡D7毑t��1鐥矚sH儈uwC:K�钜e蔦箈+D€鈦皰浠d靜隤_侗柄Kh$R沫銂V与�;訂u晜.�2鴽%�锟贔ZV/'峭�%斯熐晌砏e駧柴鳨璶斵邔繤�撷^騣叨1楷曍鑈!O敏恁i 昢ㄕ� ]龔,&Z駸追uW皘蹰韌瑬[��kk胦鉤3豤鲝鷘璂By�囦帇c^򍪚�$贀$毎f菈K2 往K@�=yB奚髌bSI��莪咊㳠懍�4Ho �淢���7t鴏懬�+伐I瓓�沱事]'e冖mK鏅�:34崮�5P�5緂8}慙湻Eloun韮絣'�01�1X琌�%愌R`躺羽鱺餋穩)T4俲�跳6`9�k硫E�巖郭饓$X鴠Pa競庬轡Z砖$笱譎(I 鋍z窎�8弋廿mS縸zH �1y罺墖蛌鮠諿=鋛�3�鬇訊Q彟餹T�.輟L瑎��M!L�?t�8w�9� o =n�I虧w0恁颻�k�;#|O�:s睇傾S{:議|褔�ZV/+-G� �dJ�2/�&>n螂榃� Z簌蕼-G�祿�,<0漂徣S,睒9�$遰%t甠E钶棷栱镛棰趕�,�>飔ml�+鹒寬�|%_霥鹾�>嚲厢测导<镺iuj� �ī汾�€βU/皋磃9賬zP抭槖W-体 N�考/黼UV襜j補s拦h9陒i嵐Y4醬� 迄鎸s�9笾p_骾鷚o绫燹﨡磽饕攥� {&痷jd� 褅梓�%$<2峐柱燔00�%`G 彁�=Z试袍彗MG錕\镒闑0塔R6:`摨滷妶5癶楋剨'吧�XT3狛A� �9S�%V鴡' ^鸏�4褶�5怂�荍�*緍钰]眩咟查0td霾馲€t�6e埓婧� \JB}�JPヅ�F昁藲冪�-酳H谥� o€�-偑d#.殳┮䲟9�@� s衙Pln,}羞�m�"呠d9€k9轠蝉(敭姿-5<癧穘}浀i髯�ㄘ羁c濕?簆_坬E菈蟋"`S[丒q閥_%v簍� 楰渀.��0d賒疰�2浍�2M瞲�)E�"G葔雡鋗堟N�'{Э%o€�?sMc�9b�8Vr€U�<m�,X�$� >胱N佬��6�?ЮO�?蠶帔 � 齍黪养;餚跘2氮R緲氟� 醐�x矵�"擅}挚8Y� **�!m嘒迫葪)扻v�9�;鯷��2 湥�鎙C剆伛庸V鸅�+N?�0]��.他铐埯轢~疵湹孶*攼�&0熃J鰷怐橌RP|h襨韊軠嶁`鵕c鵩�>滨脸$飞辞蝠�7罢<€�+A�卐0G2�$�;Ag�灈2HI�9せ)C喝泘ue)吧泘�% 蠠fB� x�€%償> �愻so寯L�=曆y洡DAwy]��0M鉶�*鑻�;^脱袮V}4@�y%庤�$舴鬫k�萵�)nB煹a騚閄�*鷕G免鎣L鉏柝黙猌7鵐績e逦搑;蕺苼e看燅輜浶�筰�G�k@�?(6l膱嫮>[�婀噯��:魼胬d�焘澾崚瀇虈嘕�劯u觗殶线�坾繾�2CF厅K~櫔r� 毁易涍瓙�塁7鵴d7iS硞渽'耰哋]喆xG麻脋B/-x莰_'�q/妨�:76猛熑藈蔁k鰇&%屑O守_咨H�_髶)otC踳%y�r鵱(�3��5GA趿可��,每[.縌轰5猀�7 #z1鮫麧P/娬輷^徹箎{G嚶颻W€趿陁ym囫��摕�f居K�>昽栵L訕s�,攝`�乔K嘟0佃St掲@_齌ⅷGb1M)C�(鴱邶� DB�?葵躑颷幨�+鱄�H)W�&��噐睤!w�zC'E,j螿鉅マ�!|�@踾帑X3J媕�8掗ov枤e嬧�q燈弪輗粢-5�'k繏舺N�;楚抲`B烡�0恮朋閨6�&�_/矵氀LQ‥z6�)砎钫代阼�逊馪�E�Gk�8:L`X穢n呶�7魺�*�-钰汗瀤�:捩�?`06蕱/�綸��JB荭桿�:独お琶o;(c�0呙�2䲢5殺戯鉤5浏邜W縙繦珔�X鵠醥��+縕鈁� 怢2蘿塺 僄O��l塼頲!�9�p虐�>嘤*@妙襀%kPH�i�彗pA遮%Γ�� 衞據m陥W烮~頋.蛿︔xm3鑣寅p葑2 s5惘=Z憕m晔7�-'/薶X ⅷ�0/协�幄鉍垦Mv}9膼z尘_�帔桯�7.�x抾に勥嵵PmC焛嬥i擒X泘z襼e$戻��5 掄绡窊�+vK �,� �8.O� 匑/eL铫�L:mkW历谑锗P�)旖g鋂糏4 韧癗V]J轿� <4(�yHc饘own,�咾i�棟K驉R.柿S�%CA|X淈/尸醈�"畾橐擭=�e 4�疊k�郐C庥�m換so蝧��鱕醨d�C喻g跮羔�7廱-暛\�w,1值g隷寪C�&齣韨]綾關H.s�)电\�,H_� 歚馺閐堲涿?6J0R<� 嬇`�>E H廸禂{p0€g+榵堝毶|W甽�9w&�腜#0Y�):4�&�t�/迴U�x`�p 糑犉咹�:C�饤虄狣�% 樫B那�6��5例gn/�榆zb寷Af�> r糵驙洫钜も5�Q帔Gk鯅e蹯JV=趛�w焯崜:@?C挃o€2汚0眠弞ECs=猝5�v紉豪鄗/(sL8樹e{N� �5l揦夊ou芔题穣$]J�>谐�m�$坂&ｋ��.@=>�+翔� 愦憄V,/N澢i�4嫤布�6�!opu烖�1A#�6七h伢站�Yk钀!鮚>鷛+�?g彀璖�g犸&� 鷽>蚹思砬AV#�5椂衆瘑=n政�挘�,� `蔶呁跢_罓鱨^Sz4�.;a鷜韣860氎K�扝[�璋�兄僩K^鐛恝笖蝣�?�10庯鵽╝连i ,X鴱`�熬橏峠+��~� 迢!餞@攀=%_摚綍㥮觿)�0鄲.M嬟J�?爗崥嬨栮鴚_� 掁殂辪d妣域�� %磀|?饗叅T蠅�鲔4W礄��&鉬襳驔5kW覱M壹V滜�`箌斛暁沌概兿94s瘁迳s�1�X蚝悴罨b杒�3嗲戄弩%;a�A�*A�澵)�>涍欲韧~玗齤J2|5r嗹Q 汵P�翱爙词蝉沪�丑�,冲蔼昉缚?$蹿蚕淭2筸尘罢赌归雭�;濒涘缚捼7┫佲%皑涚秺�<鱘M:鏝燍��迖蟎�)儭g�蹊� m�睥�!罬�*蚯唤a╚&巶� C䎱胂蚻蟨喁h�:偁贛& <1T0,佶�0勿萮%=�}豭wJ-�>零走�佝紗屝隬.锎�~塄栈N粊)件轩�T淪L燔鱛摵e奍蠓緯4T�+�(.(汮VO寜ck>騕�&~铥}臔v孍�-筵&>�淪k砕芔;龒麅鉍k|倿Oy.胪譤-稷_枫}�/�.7�{�2洷\撈灻#�QJ系�RV飨z鮣7� 悓怆�,�'I餭騪\�>瞷3�黥1飮雾廨嚥钣乺嗦惭测碍肋纸闃�瞸5鋏胊齿'痴�;+颁环�!憦词9飞癫滨埸7啇�W愚赒蜌:j�9�=枽�屌鷽 �9H啘媓澄�#侠Eo �観酝5Ｋ尊c馢?栶駋7�$__彑>y鈚踚雓>峿f�煣v€X鄭�6�~D!�+7�P^�廙歝覌跍a�""燎=Y朾耠朒D饎契�瞺:�,?靪E )x"`��3慟抜袄tO縐攟�*Za(诞�峵(� I�賷f靤旾[荩?H C鸻眶>喾V亰 |┲3櫽氅8匦c�({�7盾SB#伤笨fK壆Z纼u�x互€�=揑恝d駅O蒁t漸iL睛_愚M`7(� 穳F0凲.囑胋JM@� �8瘷阷�爾#i鏝5說廳爒拂喗謃掮紒芗忼f-飔o![(蘢�%B=?啊~偟◢�$媋�b咇�澶Н邥絒哨齡EK旚纸韷誯至b燋5痮跍籸鉸嶀吖V@G邅忶;餻dP'�壦稺幜�3V跸礬支€\亜硃� 薺`猧没蓞[鱡1躪UJ!|>� � =m*撬熃焾В碳6剬0猳T~[嫺`‖�頖X#H認E�9�/鈿,��*擿Wf�$�篾貁l挼湇(,� 躉w�噯<�厝戂鰎戤|@/f媋皾j>p�6+痐,.蒍榸_U]jォ�2屳�!婳罌仒0晀1�C蹼p甐贕>@o&�w灐p遡傕 ';轲b%岟�'Vi-� 攍�?{飓垕<(揍陓罘1Q5*�+€顦�i檫|汁�S迾�釧8稠�>R�掓蓤�1姺�篱郣�螺Г�磪桖%H軁V橀櫕鳐a*m瞻�坺I挓zFH麏�$2轟L�6蝵ㄦ€栺I戼鈌枷{聤缩�颚稆L€ep閬[I�<@g厁`Mn螄!蔷门X噬�b+锂u桟妆q蜕邯8YF谩� Kf# 摯`y稺+欪FG幣5繌撁�驅涨`0慏狂?I3鋺樭可詒Uk|抭Nr鷿g娼∣1飲O�'璭\D搪4婜VC誊]'慕鸊��1Wb啭@閺\ 蕥R羶 &�鼤束敊蹵*槀]�=��!焨帞�Jc選塏�6Q呠��9SwT篾�-轺-M�磽菬晙菳�>奫喜丑耻�尝词4癭诲�皷��讴憣侎5��3菿U怃蔊◎^蟥�s柑r厽� 4鎕�$噥盢=-侶R鲟_W�$窄逝斯q遨饫昐髧�鏽8B茒雷]抻�酪鈪膊薏鹕R�%谥珤y�觉c�6CJM沵�-_鼂鎳晨�'狸荠ヒ棧瑉] 1~堷槐緼纜P;扻r兙擹#緯�冴?oE�喷``]煟W�4慔^泌vN懎飫沈7K�.壣�*w淔J26~k9懙n<夆a�-慳瞧�:瞿G.E�/瓿鈐/.6 �O�3E胇�=賖�?Z�> 戓嵗鴆螬i驸.涴篺�6奂鲳�:镜銍咳&豓澓MP蓒U�-�$迌Z銉屪n=0^壉� 礤锥miK廸u峕蕌倩c邰纷^鑧袷m衮蚚覒�輭.C-厬�:葤⑤犢€&A懞揁蟝 u9瓷屵S�)鴲�:D*憻<��鶓渿`緛蹩鵰牨Fz垒ZD.艝彧r)�(K塳r3赟j��9觶�sx*�>xKL幒 � K覤wl蓂2s IDAT�梑兘ch┩渰汖i}�DY肃r��/lf�絺`抭1觮&膛y譛lB疕缹蛡� 魿圇抝m涻r暸w枣:樷疹]苈斫�▽垦轅沒V@臢3�)€貀埑閫 €其�xO@发曷�8�T\2�H炧�4gx槄呭袼 €墝鴣癰r=當8籛憼嘎�/'蹚>*�蒌q釴穸�oD=匒瓺�釢e厦慂bえk�.LO矋攖厭� �,X��-%滰狙��兄R�9绣n┐б鄝鯅x�$宿憦る蹷铲捊�#盜變徔?@猳u﹨罇甭z紘5芞��#z﹐.KW骆\r絙w秫x椅S樘傀�襡"阮弑W!箩FKcX餟�铍�2� Sg膦l渀b�%�m业��)5�%[算[9瘠笢�,)�J垉ky�7趮UJ<虻巧甗�mf朢iZ聋I6R�)R苉灦袐箋CR{殮鸧向�$�%%�*嶺i鋣_��'�輵觐從炭店窌:z沬c葅� 镔Z�5蜱�0y`��zO彊塈󄎎烽O鹎鄎刜�僌[鶁衣蕴f緬q�2?a翰�軑��(=燙胢鐰�J暣-斿婚np6繵Q�:姾衚�/�章嵪B�z猼雽誅c 染� 鈋&=奭旸� 胵駀謶€g�%,貵\]�A︹q釪L�E簄B瓭U��幵)|荲旬鰷迒.aY4y6騻|焞�驉@森狯Hjy凧�;谣�5U�>卍y獗⒓觕癜楀黬j湧ge銻錉 P櫗f�掾�孲瘪铂球LZ�('�9�1戕iCn冬u.J鳳玜�/�;�<~�� /5�&{檇�蚹gY揆)洉\`jlBJ�]透 n鈒Kd燓局琎V墀.}_�芹赊G�3�壨X觏�-鋳�+繬鶌睉5鏾蒧珙肾O錶hb 瓲�%P盿织慗磑齸阝髪6l斫田h亰羡X龴'�5l垾罸d€��2釲{吜鬵)}幘蠥<珇'�嚉z�2$暭#�蛐<-j*樣髽跙PT�$炏u鈡\k�9讆疟玡�鴌諯檣擓J�0珠崇�5櫞辕rq/Cc埈敞埶/奅`楫櫍� 衚杶E6�29Di嚏E# F棍蘀�帡萌!jee#n儵帞]ˉ膨rc 帉検鄘��&e�>H ﹛&璸葅�j閥)劓�3瑜寸┣濲~咏攱�岍M?癝�0y奋)��峢h縡蹭翪箄s兲蟉逗懱遁U具镹叆�lK#揓.zg��,顱q}价曕0��6T璡┇�'覿蕬�8Y;灨蟾],'�$eY讠rj 鳑矛皫檳 -Y1紘莞凈狝煶碔觀��1R失鞎阩Q鰢�wɑ;W鰫5桟%61EJ釞#-侺jR歽鱤侷�6峫橄癊傏��:�Y�3�&妊煮狓踢Bk =較攮蛗 H骇=覰*r�*mフ偝r/aNh齠�2�鸈s詏G罻e缉�4冯犤s~€寍~ t`藧kB�62v�谩��前芍0GR疙�飴'n圿!w摚莖#€�&举� 撃剣�6^!肑烾麱<* 繮�3D.礄+U菝�朧&�5=涝�+�4録\�Mm軎j!�<鑜�}�<%%屏窶朽攔瑳瘮NEn獚怳a?庍袳��苶9�[7Uu賍g�扭r剚鸑澼威%3{y:\~抃係鷕�d"v_d昔d馼λ喹F架D薑悰黢L4llAOh囂T.hKI錄j诲�鵴#�.佥t�u性-筰蔙睑礸鄡擠ㄖO覧��,�)粴磠试猛晌&Ke@M櫺じm>W�幣雊�12壏s�*殝\#袐t�胨�";�5�S潄佧钭�陬殊錶1謶凔鷒>~E臁龷�(S稊,晔鰎e缸溈魼R爉�-`&@�晆袠麬碤偅挃�(⒔簂�7蹘錺3z,鍡eZ?*;Y��+溟怱-��&H痡^铱F x鈐Y盗�飌脵茷誷�:鸀_,蝳%珹~邹,剠�'伣�eWW肢喎�/賥晰玅Θ:=I牪�=�>龖俫.髄�:�飦�=墔紪挺浣KQ卍埘P艰/冽▽2kf 薦视U,�5><#撠丣亭檀9OU�筹躡R蜪倍u6Iз佤r濰<縮�3€5`@l�氄H蚌<啅鞍Y)U猅攥艴l隠饟fT$v苋繮s[Sv禋咩吕J隸$%藆徕a~閿�恜a湱鋬€栻qe)鐬(E@/陆�2俘鑌�騆]暒@羓疞6�媡砽哻b�)�-\:�*__k籩睩z硘S�悔5��:哻^軇榛笳y�=3Cw!瘑]v鯺D砽簶5`}9uJ�#�!藹g�-n0騝娅`u󶴽\c+磀"s眽�S娑⿻O憤!謇椳Ox#P�8节>y鏫[H]q鶜?髒给�.7誣$＜� M椝雱捿�Z綤困津I偅4+�焊6︗ 檝稻R歠58AO摉3OJ諻�dn鵙日曔�#觓潴"L 曄'} q觬�cun爪肸铔l韑 LO觏�#�n�'実Z箤&v��5暁砢�S顒bxY▆R釕桥詁� t隵 邍q�Z援)�.焻锖A�0鈒;芅(a5�+�-��6[孠U�Щ嗙P繠%錃�-b萖��43� v绸鞚鹌镫�-V�>}猏Sz 蠗梗y 8債銀1�;5應8&棛鏣懤�禓� b朙缀垒b3骹*�?o;�.Cn,舐叀濓嫬 eJ晝B漅芞)箥C<鮆#�/�=矚劕�焕劂瘂旲黑聳緩瞺滓値Q巻撯嶲R�X軇�财�,臯癢>贺L櫔伧� 慕�,y*�%�=H_�>J%}砅魜釠f/�"陂i诔!8榏�9劄_嫅钶篬约Z�巬kX韔轛廀�啘爺貊T5巛^�=簥;o囀賉鲪[4Q� ∈cn*邓撓槁孭凹觰F/j冡=鞔皘[m樽i坚襋顳2S�){�4y��*2偁�轷憞K�篾馋~el襠妍睛罿┼�$,k砀 $鰌{瀟箟泰経釋y鷺]倀[掊塱悚鯘K釨⿶厺蛫ff�刊!旯霭.轱癇@�;�&騹殒6蘶t'Z跎緞呟L崱_藋尕�^�`泺� y��底琞c蔯橵璄孶幕P礢鑰擇>s曐�>枹N`敉R�3}秉凷x拑+攆輵H鲶~韊rbぞK馟0� *?簥獗0�.俾^瑕O 灔旀€�赱$2) ㄌ玝覾磓妪e契z 沅ki�;g焭K嵼!y朑⑩錌鉣ま撖螓完�/逑袜4lu(�0U劼XZ�鸑﹕v蜐2鍮k舓e聂櫜浲P�5A琭覩嬁耨F菌�?A炟 G骦 �;N+揎3m鍍ｐ泽€�a�0R齾j�,-屽闥ㄌ �oX堡犰�;Z'X{纊萸I鬰_螖袬H=X缢擛�詨]&�*徳Cn茏$受!嫶>b`�茒@纮�L�S弪[�!Fc铠铁*m� 餌垞猲ar0淴齈%麕P �[拊+ 渌珝晛X�?踊害�Z藥嚗ea澩\嶓蕁� 囟�/�6挜u7莱栅�7u��?Y�>oXFy燆猑?焥dL\鯟1踬鞁 �8Qy�4+岰Wb忙K=W�<�8棋匯>蜣滜2|諮橼负l�鲧,J蒡%丘潗d瑧埂,で.6G鯯cM幸�0▊� 佈:Ex11`�\wp偯aH��跻燽)9q%H�-K璯{ �0圥�p┥茋#!�W}夫<萵f ��?琾L竟VWa涭睎&<冄郭�>�� B€NZ醵磁叄 €k�#_┎s0侣 k�鴘L76 [�Y*&�9燩�(熋€镍€ 絮g鮦澿6摨倞�&闠WSI�24対w卻�黻藍�>腕触槒?< 堑嘘聙斢7a b艨tX$卾��抌╘\拈 ,4k孍釻ul埦襢5�s�`�,鑔綂%�(験 #,澥@.w裣穓赡JG敺�'躂炚g�< 前呧鲄�!8嗐�:�+�s滃R@��!搼@I€�2阮蚦n�' �媇�:,寘p� ��!Ｏ祽~'^艵４/氅惂-鉅�0圶鞌`挵�擫偦鹒刲u�M�+廘謼禙旡抏溟62飊 E�4鯁€�/<繈黑蓾坸5u�沝檜"崨�78j楴�}蒴��3渧猠&躺q輮u椶勤+~嫨�樂�夸NUe鰤HrLEjt羲o塀憨� 匤z鏩�1€贁椔鄞�,U�"矅囸鋮蠯〞JB丅�( 剜{!O+"€:I嘇2趾斋S頕?�'x畾 S礰@'xF_s燪O湭逄榳�J 汏m�lh5�Ov敺ー" =�I肳宣靵麜�奿嶰J愶蹠� ;僪�蚎FR2x縌14o悤ｄ撕�㎜2ES[门#=�7rS�-璥歃B�#綹嫽U惼s蟂叄�(��€槆鍂�%唷:攻呠�8嚔察蛌r隝溎纴Lo亂t0)腴(�拾�7案V獛�5wHT�暌�:叽~騄� 諨� 5犀%�嵜ij,镎{q�>P5菁鼲:6﹣鮲�2�攤惼0朗颔KR^睇Z害3州�/躸挡屿!Z�'[�#�隶z $'m6r�áp<莮*Rui� �$聇M骀�Az!瞭z�儋_{邜�劽w#煊b徖骽NZq7;Yw9\~�慚�6葖0廧�v嫎`0羀�0I�4� ["�%_s铨蕏�;鮹 W�7懂,8�H>輠骋9妤�<@婔:轈鶠憃_豨聦�呿敳K屙�#1�P�6Wz|�縚_f蒋>�?�噐�:[�S毕螽�)�Oa,読鹣H欈铽叢6�(z S塇i^賥 r攪�*UQk宱�睗!�>uY黥犍mz2鞷氮U鞜惣Q3�率痃滐� T0朐B驸�?晳�薴x�y鮏 � �,j�€Q(諾$伶}梆7'�(浔Ld]U﹚�8ixf�4犫H�朴$Y9H幎Y嶩�;P﹋亇:駫%2fD錤诼�-H蝊$K[畣艘�昻噏�mT� €\ ~k廊至谻5编v �%^棤7ヨda'`睎哬插鷆`/渷鑐峂�1`S毗鶃�﨤峬d櫽2帇必P峺O45疖d桲嘹饀礦�嚉埀矲Q鴕C€HK捧讫宇�;L FpA&Q&纙%墊F�r蚛M6�:A��7椾綮�*�N2}閮_�?JC扂�=�印<穬N}� ^冗@^澎捖,煲朏+栅{#(4.�a珆啵� &z\鶕r就<﹦(�4u"lt叆�.]7E�64箢A剸�/x�>峐蹬�-遽 -鎋愶丮獢$[〗鴅Qg5祖摲↙��.貅 �9藩C睰P陸秴锸秡�)�".凙U�/Et物敲}�, 灡{臟r 虌嚥Hh)凉\�犥с拑▊簅?耏匝RΨ6忙)匬=捆卺�6 YVjT珰橑�%JBe�wlT抷U v0廍��5=rH荁|� q騧�z {<�雑|SQ辯癕�?颰梈畸K�:�U随軵W�.K� 裍�"鄭y纅ju牮岑��=愾�3�8藧鋜猗3!M霃�邏>8阗@繪茠 c�?e彐;_T�Cn IDAT蟥�+ uN櫂翥Jq�. >HY剌U紂坸I犗�0骪#圛�!)R淯€e�026炤锫�赕滌瀞@瞢C滆邕禀時襌徕嘿YI;�W^ SR�5T鏺�&祴� �gC裿W@誣瘈闀鉣%>Y$gi`澲��3�&禵},怠┓G闕@ 蒬€W機T�7m�)r/轒@w宸蕿Q尵靓Z鼖屿飶|瑝Z*9o�M1旻蕦魎1U詃g�澰鞩Ta涞��5`i9鐽B菰孈:罅3纃肒%emTM叭嶐閂偖� 鬛Bc憟惚襹_|�%蚉X�颮辁z (Ek頝鍍蔚�'阄窋2溥L彨桒n"^遱G槧�H攋o�:T8+狊�:飩$偣' !Xh�€9弭筅c�2杓忠`廬JW圓=驡鑐犞k� ~穨辈靎n 惽p曖'佃@�6艾�>=嶑Z￡�._�隶 �2秐S�4吤麻�L檀狲E�?犖�6u綯: |Q暥0膞皎S3敺⑻9Y態T;Z兘�鯛L�隒袻-lM'=q`2)潔侓W哇Y紲l逄�礨糊K#W�>⒖d�F~┙滼,0昵噵?恢N�3丅I%.扚b飘� �]蔍棅滗�:2︰)l濈鈸&��3`u蕂�o戺\�3��8惌:�4捥_�妎%犻� 孈*o曐亃H獚t郺 x�格]~t樌}<]澐8SV&尩~葳樍L艼��璼枘1x撝鐊璔N^*J'党�2Ep:�2Z阊D礵�2n诽猛p�/$N^Z緾脖烧^=裊-箔齁誹`��>d麺噘匋V奢怂�欣纀檞K_8*(k竻群唊U uK鎽貄囎Z{邞涰搉G簧�遢罀qㄌlL^畺�$笝€E櫦3H�祔2缁4霦Db軟铍'W:寪�#*h凟g旃钍珻樜€驮僘vkI3岻⒊圁�挓耩o阷驽?嫵zh7猓憒�=?рK 6#辬N邵秎偣%}�X庚耘:% 枨嶷絿�E 蒥Jh|搛cV劧漳�z傧顛OouWI=够侠�"阔�蒘岭愄w*uSo焟-髢j*ψ覍r灀€&緃]J>躹芣恖虀!O�;缂>帗 �4�氳屴]T&U:(V:幠趩兄蘾逡€�劐P嫢2>`焅jゴ�6缴9侓H崀�5�).尵愖b)�裀枽N慆@j烤轕� 坲cＵ�7㎞�8衱7h扺�﹫硍我e埭媟�$�老� B肸!紜�2瘥@毼�0剜o祽@�嫊9[%1�Ⅶ瑏� 皜:我�+Cq凗�hp鉾g釾跦爚N.孂a铞J�袄ox欓h桎w蝡��0�:豘骤覯�,L, : 5�7皺A頖'认愒"睈Q鳳Ep[9毳嵲E�#eM胾*丹猏2亠�=璻Zu;� �<铌纴宔*�炂%薆殱癅��牣嫚�X�^诱淐棎於於a蔠綸� eW洇S陠4執豥柨漫w酋獇呪岖�dＵQ娻w�/^X狟坜延7謦{�&樈嗢�a臖赡c駲覅=O��1 賐趉栬瓻ノA*�痃i崢B砯B钱軚簣�!M蟂羋yA徟9jn�蜮�惼\旻]撺鎑匁硧Oya)鈈'{蔁戔辘&m梜槎麜悁秙�d|竃鮙=嚊噪3纼赊�<�5礽邪zr槖�;@BΛ 刁玘�$S[晹燣菪�2�+m9魆﹐礗5i登駷2鰘+厑9%媪2∑伒�茬� T恋綞OaJ婙餷�=梠薿;幩(滉隽�-驉��,R��1B朔扒稍fX,7g椼╗@�5柿rm 愢$z羕Ay衁*牎扇O: N/窄琁啒宧]1瓴t?K=皌凊員HG�呛辱髆曉G舣�8{b*泘>~�,洜_'?�籃爬A�曵佂獖曱资v(惘.炢�4墡~^砵顠u V嫇"_Lm�G{u囼�q\N�咻rC錗e醩d'泽*恝R6€帋Q廓烓� �艩免)璲.�,凇侓髢2讐E� x莱┈媴癙q�*愐容枕竩#k飸脞e6崂`UP�e帉璗竴尷�#∷&搜Yｅ�>~R 连-��b龄D@�00XU喀萆㥮さ黥棟葁ヌ2��*��3�则�"X罕梵q.核/K�癬R�凁P�&�(鉝8>O對f熗6�Z斧絆瘏栟w�/X汢窋�;M戔~5鴕M�$錱澛苯瞟�噧 {T.h�嚯�@绷nC慫�攱騄瓲焭J茮垇魾癌\�>镂瞓騚塸⑼趯吜Z�<�h耚雮唾u�聓2K袒�﹌�2灁q2婜� 嶯<墘曀�>N瓑>XT=糖Qd踐僼�>鹜�$Aヽ'�=�囟�耻€{�鲻豗绩嫮t(�.#�晇p~^j骂�� €N妟"婔Q �5!€�稍誻翆r^�*�_阋變uR嵌毫zYx� B筵csh狎纣�<$f恭tJ繚詫�4�;C6茂匆�勽x48阡m狼艬濪@n'U{巏斌4訬&�2荋惢HSJ钣繋棖8#�,�*�孢x^I攢峼KJ滴[陙E寘盞~�6顕q�躡T-迠馉k� 幝墳E_�,灟LTqgkq�3犚5囅K7κaAG槗莎>\Ⅲ⑾耫琶煀檽曵俅{蘷�榒Q/G閄罶玖1[2丠櫌T�:野V�(关��Lυ戛~�)皝Gpn媠�5餋獯�U兤�塇壚�+蘗鹪俏�_擔�;酝qf孬!`�0A�(l�瑛�!�'+缆亱鯣鰡€n?� �f棾仂G(G<|*C@�订'分M�褭{繲]y 9$靑�z︖佻I鶾fF焧2�夆洫吚��)�=?|7J妭YO徹t€��%仙e�?徘!k�[繺�)?倓D|�#K熞HcqN瓚恽bu9っ籲+uI鷘℅4孠條M/Е�&%瀸炢B@侸�8哀坓鈕惛%�(7?駹P鯂#S^o/c{��3永億董SI躲糿+CIW�#Y5o�蜥;黝韡誑廬�*岀G� s怓=|,暀€掖vu剫O逫菻兝V8喁�8:餣�M6B哹��<薵rS邦哾:頺�Ta$�)�礫e槌�*t颁坸甉晏A*n`猙餓O&榳X9儔^[5|虄5^J嬴�/柺jH\;掄X0踎T=(]|シy妏.:�i结3诿F寱鼘窃#夜j!�b�9墅;偞g圝樕C︰�J钲﹐0O叚�>畀B題a��;6禘癹龏イ鳏?4�(`�*t`A寺U牷鱲f諀杸蔗�綶惦噸Hd欱lC�q��:加釔$锬� 撨閭SNJ烯笠�2hg揍旛晟�?7i歽}瞥�獘崊斞-x鏁*叅Y)w鮩圹洰?�軂痸沟綍劽�渽X涗3黃[痆�A 寪諦蝙D�#�.骓褐&荪kz<�+~sd嗌幉伾F0FUL貓.�豴p磿鸬Wn衈N腋剾舡�->Pㄒ{鯎=�J晪�z醷窄YM櫹密皎򊔃d"毒-k玿嗮�疼q鵥镟麏塋�5(鏎`稁�*K籒M7d5YVll汰>圝x_`踪@C0}�磬�8#�?崈A簤��+胓當h4OP鵖TA沩A�1/&�:WJ7�&Y吮`'_ �_椙� 蜤6罶嗾jp@揔閛D&e旌i�;P鄼Y}'8�<2红]:�M|穽��*塔f藀疚>5嶦撝舺崧驾1蝥趉�闯涨缚獃<�;x>��>办0鎫1滧迟5%臇晑7騘��礣痑�厗=5濒摆譸涓�寻鹿蟪鷴钯7�?瘪赌?宭1支苍碍5貥迟縢迟�旋勑罢�砷��$ゼg嫊cQDp_�u7K(H|8 ~€\ふp8�;�7秶捕藨铗0奄d堆譀塎n#zHO昤斘e锶贛�Y翻�/驍�繑 ��IUχFi巗�\U��(t婹^镍mZ#)�/khV�'秨'瞚9{屌郄.錭\�h^3占冺%+? #;6斎-3dN�'P�$缔�!u!簿蛘B鯉�轂瞕;~w�致�-蠓杶緛�觢s� €A黧緣#貇梛8�)壠Y5奄蛌v玉q�TT� BL�*[瘨H盩伒!菩蕫$�/k 奘 '閑�?ぇ�E蛚哂FD;i鑭Y畡錉z鏳€邼妉婼栴续&x_ s7R%}[�r�V*镅咂跹皹抉佪个kwX胤ㄑ�6iMN3�-徟楋�鼕�/�9Lq＋郌*縩>"?捷厂#奥<'e^泴�獙od�B_BiP��x盚僜�9��.9I螧莂晷抷h飄楝筦在"珣袩u揹�T妌獚h�9v%h奝"偻!緋 L愵%頹i抪峏�'咦蟊憄Cy-� �g8VY^w=tuZ~0鈋58㏎0DN^真4K琽阾Q条曘T�'�/`]a箦�2}�>駴鴽晁娤司锶dA嘢綯F吭I麦衢x�>t杣 �.|撚滀X=;卟傳:9砻9�*渋€�嫦xy簬[)[犰Q疕縵r�0�リ>颼逧逩!9甕pN#�gxX鍾j䥇刣+�a鮮�9耀�5塈岙Mh,S� �d枾z衲A]柊鼃n氲魷�撡:箶弰�荁b"繊墢釗e�4�3朽檈l� 蠛唢8"彙齖&�&荪?畑Xfp11瞀�,M"骧鱍=1鏎0d苼鰈﹍�>埦岩��*埰骇窜辫<柶BX贇€�鬫A剸篍}�瞙�1顱�<桛爉\能唘穈� 闾戄菭�/+My撤窏垿沗膜�(C囨弣U�>}辙4缆陸�?揁�漯� K印]丬CPZz仧u�灰�g偌徳彑U�<*i摮鬍b睠b53瘣Sn>鞱P瑸幃躪%�鈊堬yy)A蕝,��,颶踞醾賓~褂B?,�農�+6�鸰某橃�%∨溑讐!W��@�燘髊淌w纂�'棝)�IE.吢�瑹藐5亗搝�璕�|莁薳痖�%熒 'H€劈Fk� 癥e�$n1檵I錋�钕k實闢1�%D捅<牯Ws铓霭�佪?稼赐{G�t鵸G�e�S9w�)忮.w��;世飾藎dT^{�,ē瓬&脟偦M�饾�孏f�'岶稳﨑1頻�(短Y� [�}�FW驠邪]x�$ J椧.槏O�4獣RNk郕S钟^N#€�+RO��/�*菳縡�*箼I�345m€畚悒dD�$�资穗5菽��$慌誕睫�1*-�<鴻>I�bT#梻�hn0緒蕽杤卭)澴{舧K鐭乵T�m|櫤� >�<烬潶> 旬燒)e�熂烛E羸鹸�>W'�j塻 /o8↖徹U\k畒\x劇鱻vr蚶頨欄瞤!媈e~蛟賡\丈�>�3|秇洣��7緒�夝m犥焢Tl�7刕 \-朞$縖�8;�,t�躵�5�%锪槶M�*S藴?垥�:E葅蚦R#w辞嵢蚉Jz閬��9-牛f撚��鶥s审,l噅!}褅胋班L惣�:1c'RV2晉]��標 Q9� L�8 臉ZMLM�$�鲯澴L*K`黱d7Y潌eU)Y}灘=荈�%鲈7陔�-H韄-€wV蔘觢汍湏gk斏涇%趚东7瓣��!�n�)訞#�Q�㥮F囚乵u琑鸑�%Ut骁3緹囘墾3y�(`PDf�rH偰B魟] 撩�!!槬獨�&8^~� p枬椥W畾%�2絇�8A�:忨 x珶翚TE�丯窦�qy�逪� �(�0�:碉��:炷亖羻亊u 醱�m簯鉝V莩A�SR箈!iz;m�\a*�8vZ遶钙CfyYE諡�.{车g��?�-i6z錢怇畒脴\7貚OB€h纄襥�6鶗M憹��2r过潘08倅癶;€啉k'{Iw煶8瑒Jm44乨嶼r|V厓錚8盠嗀牛�3簝,t慾蜛箔馹�4 f}鱙濑-,SJ龏)�,_�.cRajAvX甩�T-推现�:\镞稙|蝎� 澘�k胒龝FJU8t罙_.蕻a6\燄Jk賨�2擔\l\�J綊m蒆爻}8盍璷�9�2�2 "玆�坒買SG婶�4硔�蔛�袍\�2&�南�3y2恔d嫵qZW堋%H忪郪N:挐B穾_HJy�l儸)N鵍��%aFBE嶑歟撷�Ri+忕撃珿�紽�'*�>R€0璓r綧N+[誚�(�奎渋_龍瑾�&.6IX[Sn勤]责o�在旐6跊獍艨5鎓zF[|C緫�搀b�6肔I鼰嫛V�;憦q昿)栻C燈2?Q嫺 q魅{蜒:��2�z枽J雍6Bkr�鐖刓>�≮攲1oW>��1J_A�8䴖O:cu\~淲;鉺蒑饵|:6W$闻2)馤H祐xS绛�緅J~殷叢齬f網嵷鯾([Q�1,犒捳W⿴d婈]nVA 煅涪�2梳mL窦A�燂敉侂,款/碹级C�蕸邃U��);齔措c�7欕鮮騑浩hQ3}孷RTO�/e谊爅鯚`謲霡PEB咤�#疼0硜o誊瀸z~ 觗:月枏0�攏溯~ce1�.1€� �鼝祯慗0l鋿�"�"蜤槊駃OZ瓔YN鶛趄"懀�媣56摞a%�2d�捇鞶鍺绘� 鏋=Vt郱B繭*�,�煿赈鲰;稌�3跎3g陷3q禱�湱畏Z]墜Pz�"R霆N蠗4彵鱓 (S笉彿騷�(轡聯�骚s墂t�9> p(1n玝覤g蒤�D襏%,st_緖沩祧\p⊕挥;U5�&濐�$2C啵>X嵳廓鄑6乹�軙朠カ*.酛莍�y胬燱腧>芼�萖�7C泛鸲�:�#榵避�9� 鈙;S蓏<�-M B郚~yy�:_缟骉瀃伬-#V魑�z鳄B粍浺Dn斒浢箧X_4嶧评mH6荄呢掌>鳭怕f.�;僨�0嵭藣F邵豌觶:撙gYi�9祈菰灦H晡V淿文X綝虘戡櫼]4y鱼螞鶄iY警︰艪醞傒霹巹O�#搙�$P映l螱蠍陂�$f}越f%鼍�?累(cLB蹫�葥撽c圩5!榒~橲b丠�?阩r謞域UU16O榴29p?�$7楯=>t$s岘捇�>眙啽z贃锛藧�x佻�>&}�溜懅柘穂F,絲螌i鞻滼>鋆,�補蚠坑墫鯈K:D诪�#�鄜S g&計l€QS麁+鳂,嶛Zf;薺湺F殗咖举类�+ FL� a兓鷠}鈬z靷y1鴮E3I琿吻�9/緯oQや槦巰H�'1S7%啡uHZo脾蠏轊-!孳鼺悾1�2*�7U凤8鉼�柭袬�/�\槹X)�紕萎3蟏cBY稷R�复途讁 2蟃og,汿4�й专�[黔礫岜b運璙潯嶒?� /N~潏E呹:ぽ樈楇6邳専虾�?aav�鰭�瘙侶s颜� X �'�揷� 4﹦�64墊嗢X$�詈褢煻喌&廠洔�6sR欒搲瑘o肃]脫袍鮑畑婮��J酎�4&堽k寊蠰邧藾濃�*幄訡V坂S|K蹏T夰竹�la偭怞鞅0珒p�fA�36阠哮黜薴=Jqd_OS妯g�3 嬻>曒4葪a另@*麟nv卓刖M;v齖�4�.Y?)堖{琒>�冲鸻兰测冲袄颈6巭�<鵋z摡~/V废砼窉陽萶&v╧Bq漖*濯B薂�d殆{X�1驦$�6F瞀�H3蔘T*R!铚閇!其}鴚挻軽J#椄j籗Tsf饤)裇粱�"躬攧OY鏪瞳Xe�%>驣�x�H�8皈訄鞁閙鎶mf淂p汎嵷o焛3詻�,崙龤�dPF.�酠7|卵暂痦辺)}汒?o赘謐摋n鑫'衲靆�=绡v�4Daハ�"6ζ餛攗�09蘕惩LZ邦 �FZR戡��3榿U概'Ⅳ資讻C嫎f訨溄r�a!玲鵢t�G� �=捸|櫼|5+��m穔rw�-淗蓕釕)L艔顽;抌煠3k6R邁锕驯 I刳&AS蕲�;烶謩@R鵊�球~uo顊哥"j浥C趻^�7ξ�,诟郜诹"t鯂舴dH$飰轘�g�窞g嵩馝諨扜�65魉oSw��;恢o圄睹gx碘Z��轖柱V钟93� |糧~鼇而鐃聆脀eBA�=�0~憅0vu^6QqL陇4D浉匏礫隇k贬z_(,Q映�=菔�2菔泥OuE'λ鉄�*惽力�$�[轆禦�;賥:h珉睑w�:蝽峏0M饱68貲+w獿 l掩 W〖軄偷踍贱=鶬媒?M阨鶰]b�+:G辱"�8埉� �塉bX涄濴纾隫疷w邗{鉾��u玍烸鑱逩糡禈'r埙炁泈浘鋞��<刊�>E�)起慬礉� �?S婽匙�0oTu厠0湏sa)�?R�-乾a=墨雇E�亣%2L�&乵�6篭铯#崘姙Y舫sl35w~S|HZ騬閡�&⿹��称锯仅�懢)Z~鏩LM�fh嬯i锍�珶忽踿蟩貖� z橦檔試婽虂鍮s过{忔ˊ拦�眇n�[縕繝思怼媊$;S砺岢V�-:趗檣�g p�+��q`+�>\非]溿曟o�Z缫_}很|瑰;lP€;轳u莥�)� )r諯荓閘绛zB^��推慙扅渧除鬁:獗R佤:�(i�1亠N墍罣jSwl� 軿6爡i踮@檐蘛1荖槉rX€0织*>�,镑諩*禜%谤�惫产罢,糍<&琑�/ .亲唑吶M絧鳟�+殢YV|5谲蕃I呩谮\湟�#醯蓝�#鰖<�2燥e*囉鯕魂5慨B �/鵶/b瞗愃霕V�*慮O龙圇�缂莬异�)椼溕3�!s@[煡�x �"w.�褣譈焀濫0熌)c !闟/T�=嬩蛕e�$茚９f0踆嚭!&醙毻惰抒曬!柣蛡T/i鐊�-妛蓸妤V�蔝"��7殯~St鬙5啐4d撥C▕柨7}┟#�#-酘齕�<$K瑽蓔RO痕D�/�€ g(9瀕�籓��$篓�V%Zc_偳PYy井聐&畘c吭A.%k~<鼸畴Q茈 �;￡C媷df$<eB+<�8綪弯� f�2犯j$弈尳~檪癘寳釽嚒洄缇c厴嚾淴洦欰x嫟轀#鮟貑a渽�7褒得籇劥訒繳载U趸D皱}鳺�?s櫝侫庩H�衙╨I湇绔?髣ND鯤挛>B'vDFYW K巏H)癠I摌抴n蓰抄#*i潏閃�/�鎻>9�!誙鼬痴�'�/縗笔蔼�8査�<恊>P�)e�;>℡p蕪@3咢_E�T飩匃癩6)h�#犎&8嗶貒0�('F#�T:金Q_诫�8A#剘險奐A龂~a�萯fu8C�鈤圉濤[K脥妸奾酤鼝瑜j�*k�'�8W!|X鵅筶Ffエ$2逆c陚嘅*{�鰿抌i汏/陌蕘餟L@К倜鲏魺揋6酿P�;e齍钕#P�-阁n&)G蚷煼@,惬Iv)倫I?�6つ#'断黡凰扦Д:�4��晝UU~棴SA绢v�)€GHG靬-喭4Ц顓�-|�.�3枉�@襏0鮁耱l塿|詆獿j剾_5+揎d颂d韸F輩 �<s3嫓�3梟2%￡_$s�,)_��!朸董+簘顶鴊$n�魣w�+蟳J�f.麤(槹T�_∏�;s�7?LX 蕜l 娩菗"s�0�圦/鋓3猽M箴=�+乗 � �!s浫F沈R�/H桬�袳Io=鴔V�纱=I欆UQ�T竕+N�AΤJ_.{淛姼z'�铯痹B�0€8糖P嘸慩涏2�瓄~ü {鸏W縻蟰bz�<*jrF趧抛jV迪8茾/镊Q衶x莚鬞mG婉庠鐈~.琷迺贵�+猁尶�"柧f缰陀G_>他 +oq織=旲k#啜!%B�[贷Z罗�1yIg恫r蹬旈寀焿�hl�:ρ粨亭垗�(�&j�0珣p窴[爯Y锘.5&瑰[|Crf_隤0�8黰%/Q地;�?|cNk幠[柇璜铫哇訓抅/崏DXY�"Y(c店P(E墬判|�&海S跭d� o]薘浣�6�4S棎锸掌隴堙l1熴sU禰各8.莔雱x^z:銓'�▆丸�轓望 t洙󙀼�X禠塯�-|�:蠈頜p`vC�HlQv>!�7�<�0綥1孄堚=u灙$�R%�頖x贏\狑s�2遭C�6sS&胟ㄚc�)8迈c 龔謦WOz M瀟i钕� 9潆 �(*芆�5 �鼭晖@鵗nOeE歐x茢%釿猷P �#q�疲F�3Hz�-�v譽_�郈Zc6i廅j?元�;S晪�5w帘^�!瞃睕勘庨芾�9<H筬749否棕m�:岙�84鮟��8�s鋭覬稖l+攢禲K♀�. 岠a呆Rcd�r1�2Tm⿺柭郜丅Y9徳起v翑嶵�1顩�;N 预鮷覮x噝霷棳/﨨&�"~頫Y-騣玈A夻i売D��穹蜊螪g7�(�涔W灞D+嗄R2侗濍浧瑜,�5&┈��3簣"鐕ワ糺妛谓偹�兺L1S╈/豇(��!$�0"��>帻碨�/�6Un肖a;砶顭h惦5X竘婺,+{�;X碻N6v�赍]娒欨诽J熘�?Hx燈~砉�6=*甆壔>#g�5�:﹦�圷WC鉲捗�+栕孈晨�0糨そl4`"仢�/�>稿譼劖坸军鞼a�3c{4今樥9G�/I�=�-0橮[陞Y�墻迦Om狨fJ弭��!怮鞬L(遑杕c\0E潄R珫M"?牦;擷贀c弱緆S�)?v/%蒏w)J詐L4偂tT+{�?竫蕵G�)ひ琮c垾�䙡箂e瞻钄�0蜊黛7!滸毢髭諦�強V�-Z�6U嬞9崵$婐"�4吮v4账凣D 嗧_(甝.3i) (質挼 Q%QgK驑_@C)鴿y(2с!�>惭矌谤痴�$迟赌�<晻� !j矟;#姝闭;清W眧騳殝櫔4Gk�rH>k鬼O*漁艬s3c�G佬E�+*ワ耥1rz叻耗喞[n噊�?h攟O迨8h璋(垴?轧Q尿}橱杉=涙麋�k�%_驽N堐�驺XK}昁 @唅�:z幧园i摝櫡^� �B睸�1g}TB揜$(瑡菍cQ`<.e涇傣腼>唹又蚥暑�$&C讛5耭佘|�)-疹嘼氯�5Z3l|� 闧$D�2喢�=踑8O�=ug晱η" 敤髑嬱V逘ts稭�'�,�85鈯娕et祦杉~疈ブ罦0�v晾07癲x@酂mwbY剟V�&)f�Y�冸7(鼴 CJ蝿/亿<�i)傐@yшk�超h>�<㏑|1磵 � Ω湪m6g4V壡b�蓭柃�8擹鯍,�嚺>潋妘噯\堦┙脉踺艟�J电}p 腝vRl{kw㭎2�"P M%�!醆bx2跕z褰� � 嗙`x豀"5芞|<�危杷nm�搳梨j V俌`':��1�%P,甙韁罛蠑J}tW�-�)斦3mz鵱幡U礲fr�&泌Jウ�b鑷j�5波お佥攃膪~'9抋rx/黉�6∝鰵匭�8[ud鼝U96� 鮇娴:/I涬T怘锉?c攫勍亸鵜l�&齏v}��.€,姃椁uj窒j斡@闉R.W5"旮壄L粱栤恨寒颼琒辧b^c�/O烂D`R鴫��(諔潟砋牢轸硒裎k-[禆$撴鹢縴g}t■-G�3埡N�"ゞ簻� ��11r€骩溌肆JRL怐|Q夶G~E奒a�iq吡鉬�N钄禢~欴恑也M︔s磐t靝償~黝uu鑇g+T`�搳_撲��16郮讙" 鞞v莇t痽塸 ,碧9臆kA溉p撸#产职輹调翱闭蹿萤堮<愐：=b赃b騱玍�&日r_;I2J瑢證y�*赮諆�萜勬�,碀r.�.嫹&`VR樳uQ�3養B袏韱�-鴁�9味X蓃.鐣晉"蘹$蠄欜R€�@ユn羱};�/谟�.,-燦$顖9y跊鼇O�蕵屏9婵丌e�?徍2�;锆;盶惤莜o┎}倦楛锿�4G1�抺;�*錛嶁yxDHr;2*牲'庭歑_q螪T祭"suC2鹐zS果G娅}裓篚襂U汢G#�IQ9�A苁*瑐苗楿�<攐鮭�5玅/X输Jtq涂秛�┮貁赥\肏m吸襸1娆'悿*m�1晜襪^4�硯�硌负褂锡k�莛w�)U﹝蚖鎛賅g煲mf麕綂d饠撩�&61厵/��靜gd&娝E苚k�0雪 =)*w UIM_9�*U換�╗>MI:品絔冘)@鵵殜岧"8?宂b銼Of�4蒫�:m瞌�?l妆��頂贬�>鯠钭尮粢溚?�7u鵩镥�=)谣駟渌瞟希€王;�(涤霼扺馣辅鳶～� K銁瞠J�僤� �/i6�3Od眆繸篹忳提銥{Rヴ�-Y繱-��$呋s青毥麮\葸殓堝6��╖檙鋔緍鱽殷6�1_珹C嵁�>�'戩*皺忢�4仧�靴叨噈N騲蛮S橻�5!旡曧弤筻揢 m{ti)a诜巴I)� v洋諪y贁{6R(�)栥?藒艿}\m︼�>尭m�z尿}培�)嚎=渑t櫜謂紏_饞-Йp阏D'较n欜RU砼耯�鄛d車.敟呗讽��!�:"=>万j黒HY瀸��'{!b6度轻噦`�6)3�tl跥d�4ョ餾釣/栂斏椪勪始頏憎3鮴c酎諞|史/B�#�烞琸�#俾ys�U唼蟑ev姳�著JwXM獪�娗茉嗨�-鹧魜&#p|He�媊N\"D9I庺7�,_G4渴IO瑀u恇剘mEぱ荛蘏簁桩佟U獛∏;J�t ��*�4i�0竜忣E@╮�8耢袺鳓Q傹oPf*]"驔食妰-O巵掕吹筎逝,K镍G探榰)4锕G=c!葧9澤/%陿鏋箸瀤8� 鷬柁籣鋭I撝羸=�扁槗4珫Edy4S�G�)挧p皺縳Y禂i襗<颕旤溟邟�塲%��$旦I昙DR��盖愝粢儆莮I\笲�9壑�5亖i#�)zS币e嶉輛�槍*g�4~|��f魖/贌笿暙d�=4╳羨w!pw!pw!pw!p�垿侢crj;IEND瓸`�3��A�@@� �� "NOTICE:General Testing InformationAgency Name:Test Location: Test Date:Name of Tester:StatusTotalPassFailName:Org:Title:Phone:E-mail:Test IDTest Method Test CategoryExpected ResultsActual ResultsIgnore fields below)Test (Automated SCAP & Manual Test Cases)Test (Manual Test Cases Only) INSTRUCTIONS:N/AAutomatically CalculatedInfoFinal Test Results%Blank AvailableTest (Automated) Test (Manual)CompleteAll SCSEM TestsNIST IDDo not edit belowInstructionsTest Cases Legend:Notes/EvidenceAppendixSCSEM Sources:@Out of Scope Controls - Physical Security or Disclosure ControlsMReason: Tested in the Safeguard Disclosure Security Evaluation Matrix (SDSEM)GReason: Tested in the Management, Operational and Technical (MOT) SCSEM4Out of Scope Controls - Policy & Procedural ControlsQReason: Not required by Publication 1075. See Publication 1075 for more details.VersionDateDescription of Changes Change Log Test CasestInput of test results starting with this row require corresponding Test IDs in Column A. Insert new rows above here. First ReleasekMapping of test case requirements to one or more NIST SP 800-53 control identifiers for reporting purposes.�% Test Method:�% Test Objective;Reference to the authority which the test case was derived.�% Status �% Test ID �% NIST ID�% Test ProcedureshProvides a description of the acceptable conditions allowed as a result of the test procedure execution.�% Reference (Ref.)�% Notes/EvidenceOS/App Version:Test Objective ReferenceAuthor.Agency Representatives and Contact InformationLThis SCSEM was designed to comply with Section 508 of the Rehabilitation Act6 Use this box if all SCSEM tests were conducted.Testing Resultstests in the Test Cases tab. This table calculates all �Agencies should use this SCSEM to prepare for an upcoming Safeguards review. It is also an effective tool for agency use as part of internal periodic �security assessments or internal inspections to ensure continued compliance in the years when a Safeguards review is not scheduled. The agency �can also use the SCSEM to identify the types of policies and procedures required to ensure continued compliance with IRS Publication 1075.Introduction and Purpose:tPre-populated number to uniquely identify SCSEM test cases. The ID format includes the platform, platform version dand a unique number (01-XX) and can therefore be easily identified after the test has been executed.rThe test case is executed by Interview, Examine or Test methods in accordance with the test methodology specified qin NIST SP 800-53A. In test plans where SCAP testing is available, Automated and Manual indicators are added to Wthe Test method to indicate whether the test can be accomplished through the SCAP tool.oDescription of specifically what the test is designed to accomplish. The objective should be a summary of the test case and expected results.uA detailed description of the step-by-step instructions to be followed by the tester. The test procedures should be Rexecuted using the applicable NIST 800-53A test method (Interview, Examine, Test).zThe tester shall provide appropriate detail describing the outcome of the test. The tester is responsible for identifyingeInterviewees and Evidence to validate the results in this field or the separate Notes/Evidence field.zThe tester indicates the status for the test results (Pass, Fail, Info, N/A). "Pass" indicates that the expected results ywere met. "Fail" indicates the expected results were not met. "Info" is temporary and indicates that the test executionttest subject is not capable of implementing the expected results and doing so does not impact security. The tester 7must determine the appropriateness of the "N/A" status.ris not completed and additional information is required to determine a Pass/Fail status. "N/A" indicates that the vAs determined appropriate to the tester or as required by the test method, procedures or expected results, the tester nmay need to provide additional information pertaining to the test execution (Interviewee, Documentation, etc.)YThis SCSEM was created for the IRS Office of Safeguards based on the following resources.o�% IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (August 2010)v�% NIST SP 800-53 Rev. 3, Recommended Security Controls for Federal Information Systems and Organizations (August 2009)|AC-21, AU-13, AU-14, CP-3, CP-8, CP-9, CP-10, IA-8, PE-9, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PM-1, PM-3, PM-5, PM-6, zPM-7, PM-8, PM-9, PM-10, PM-11, SA-12, SA-13, SA-14, SC-16, SC-20, SC-22, SC-25, SC-26, SC-27, SC-28, SC-29, SC-30, SC-31,SC-33, SC-34, SI-8, SI-13�AC-1, AC-14, AC-18, AC-19, AC-20, AC-22, AT-3, AT-4, AU-1, AU-7, AU-11, CA-1, CA-2, CA-3, CA-5, CA-6, CA-7, CM-1, CM-2, CM-3, CM-4, CM-5, �CM-6, CM-7, CM-8, CM-9, CP-1, CP-2, CP-4, CP-6, IA-1, IR-3, IR-7, IR-8, MA-1, MA-2, MA-3, MA-4, MA-5, PL-1, PL-2, PL-4, PL-5, PL-6, PM-2, RA-1, �RA-2, RA-3, RA-5, SA-1, SA-2, SA-3, SA-4, SA-5, SA-6, SA-7, SA-8, SA-10, SA-11, SC-1, SC-5, SC-7, SC-12, SC-15, SC-17, SC-18, SC-19, SC-32, *SI-1, SI-4, SI-5, SI-7, SI-9, SI-10, SI-11�AT-1, AT-2, CP-7, IR-1, IR-2, IR-4, IR-5, IR-6, MP-1, MP-2, MP-3, MP-4, MP-5, MP-6, MP-7, PE-1, PE-2, PE-3, PE-4, PE-5, PE-6, PE-7, PE-8, PE-16,P PE-17, PE-18, PM-4, PS-1, PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, SA-9, SI-120Please submit SCSEM feedback and suggestions to Obtain SCSEM updates online at SafeguardReports@IRS.gov)http://www.irs.gov/uac/Safeguards-Program1A. All SCSEM Test Results1B. Overall SCSEM Statistics&Section 1 is automatically calculated.�The 'Info' status is provided for use by the tester during test execution to indicate more information is needed to complete the test.sIt is not an acceptable final test status, all test cases should be Pass, Fail or N/A at the conclusion of testing.�% Expected Results�% Actual ResultsDevice Name:Office of SafeguardsInternal Revenue Service�The IRS strongly recommends agencies test all Safeguard Computer Security Evaluation Matrix (SCSEM) settings in a development or test�environment prior to deployment in production. In some cases a security setting may�impact a system s functionality and usability. Consequently,�it is important to perform testing to determine the impact on system security, functionality, and usability. Ideally, the test system configuration�should match the production system configuration. Prior to making changes to the production system, agencies should back up all critical data�files on the system and if possible, make a full backup of the system to ensure it can be restored to its pre-SCSEM state if necessary.7Out of Scope Controls - Unselected NIST 800-53 Controls�This SCSEM is used by the IRS Office of Safeguards to evaluate compliance with IRS Publication 1075 for agencies that have implementedTest ProceduresAC-11 InterviewAC-2Interview ExamineSystem User List|The organization manages user accounts by: (i) uniquely identifying each user; (ii) verifying the identity of each user; (iii) receiving authorization to issue a user account from an appropriate organization official; (iv) issuing the user account to the intended party; (v) deactivating the user account once it is no longer needed; and (vi) reviewing user accounts periodically.�Confer with the Information Assurance Manager (IAM) to determine the site policy and procedu< res for issuing, managing, reviewing, and deactivating user accounts.aThe site has adequate procedures in place to issue, manage, review, and deactivate user accounts.AC-3ExamineAC-4Interview Test FTI Data FlowRAssess the file-level labeling of sequential access ("flat") files containing FTI.~All sequential access ("flat") files containing FTI are named to clearly identify them as containing FTI (wholly or in part). ZAssess the file-level labeling of databases (or other direct access files) containing FTI.�Procedures: 1. Identify which databases (or other direct access files) on the system contain FTI. 2. Determine if the naming convention of the files identifies them as containing FTI.rAll databases (or other direct access files) containing FTI are named to clearly identify them as containing FTI. _Determine if FTI commingled with non-FTI within databases / data tables are clearly identified.dProcedures: For databases (or other direct access files) which contain FTI: 1. Determine if FTI data is commingled with non-FTI data, and at what level, i.e., database, table, element. If FTI data is not commingled with non-FTI data, this test is Not Applicable. 2. If FTI data is commingled, determine if FTI within the data tables are clearly identified.1. If FTI data is not commingled with non-FTI data, this test is Not Applicable. 2. If FTI data is commingled with non-FTI data, FTI data within the data tables are labeled at the level that separates from non-FTI data, i.e., database, table, element. ]Determine if auditing is activated within the database and on all data tables containing FTI.�Procedures: For databases (or other direct access files) which contain FTI: Determine if auditing is activated within the database and on all data tables containing FTI.�Auditing is activated within the database and all data tables containing FTI. Auditing must be enabled to the extent necessary to capture access, modification, deletion and movement of FTI by each unique user.AC-5AC-6AC-7AC-8HExpected Results: The warning banner is compliant with IRS guidelines and contains the following 4 elements: - the system contains US government information - users actions are monitored and audited - unauthorized use of the system is prohibited - unauthorized use of the system is subject to criminal and civil penalties AU-12)Checks to see if auditing is implemented.AU-2<Auditing is configured to capture security-relevant events.AU-4AU-5AU-6�The organization supervises and reviews the activities of users with respect to the enforcement and usage of information system access controls. (1) The organization employs automated mechanisms to facilitate the review of user activities.2Confer with the Information Assurance Manager (IAM). Verify that procedures are in place to review audit logs on a regular, periodic basis, and that these procedure are followed (i.e. that the reviews are performed). Inquire whether automated data review and reductions tools are available and/or in use.SAudit logs are reviewed on a regular basis. Automated tools are used if available.AU-8AU-9wThe information system protects audit information and audit tools from unauthorized access, modification, and deletion.�The audit trail shall be protected from unauthorized access, use, deletion or modification. The audit trail shall be restricted to personnel routinely responsible for performing security audit functions. IA-2IA-3fThe information system identifies and authenticates specific devices before establishing a connection.PDevices are required to authenticate before connection to the system is allowed.IA-4GUser accounts that are inactive for a period of 90 days will be revokedcRevoked / deactivated user-ids are archived; they are not deleted, and are not re-issued / re-used.�Confer with the Information Assurance Manager (IAM) to determine the site policy and procedures for handling revoked / deactivated user-ids.IA-5�Users are prohibited from changing their passwords for at least 15 days after a recent change. Meaning, the minimum password age limit shall be 15 days after a recent password change. �Users shall commit passwords to memory, avoid writing passwords down and never disclose passwords to others (e.g., with a co-worker in order to share files).GProcedures: Interview the Information Assurance Manager (IAM). Verify that policies and training are in place to ensure that users protect passwords appropriately. If possible, walk through the office areas and ensure that passwords are not written down (e.g. look for sticky-notes, passwords taped to keyboard bottoms, etc.)XPolicies and training are in place to ensure that users protect passwords appropriately.~Passwords shall not be automated through function keys, scripts or other methods where passwords may be stored on the system. �Procedures: Interview the Information Assurance Manager (IAM). Verify that policies and training are in place to ensure that users understand that passwords will not be automated or stored in clear text on the system.�Policies and training are in place to ensure that users understand that passwords will not be automated or stored in clear text on the system.lDefault vendor passwords shall be changed upon successful installation of the information system product. �Procedures: Interview the System Administrator (SA) and Information Assurance Manager (IAM). Verify that procedures are in place requiring that default passwords for installed products are changed as part of the installation process.YDefault passwords for installed products are changed as part of the installation process.�The organization manages information system authenticators by: (i) defining initial authenticator content; (ii) establishing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators; (iii) changing default authenticators upon information system installation; and (iv) changing/refreshing authenticators periodically.�Confer with the Information Assurance Manager (IAM) to determine the site policy and procedures for issuing and disseminating initial user passwords, and for requiring and enforcing periodic system-wide password change.zThe site should have adequate procedures in place for initial password dissemination, and forces periodic password change.IA-6Check to see if the feedback from the information system provides information that would allow an unauthorized user to compromise the authentication mechanism. Displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.�The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.IA-7�Checks to see if the information system employs authentication methods that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.SC-10�The information system automatically terminates a remote session after 15 minutes of inactivity. (1) Automatic session termination applies to local and remote sessions.CInteractive sessions are terminated after 15 minutes of inactivity.SC-2�The information system separates user functionality (including user interface services) from information system management functionality.SC-4Network Documentation�Checks to see if all FTI data in transit is encrypted when moving across a Wide Area Network (WAN) and within the agency s Local Area Network (LAN). �Procedures: Obtain a network diagram that depicts all access points used to process, store and transmit FTI noting firew< alls, routers, and switches where applicable. Interview the System Administrator (SA) or Information Assurance Officer (IAO) to determine if all connections to the Mainframe are via *SSH or *Other communications methods using tunneling via or equivalent FIPS encryption. FTI is encrypted when traversing communication lines (e.g. T1, T3, ISDN) using encryption solutions including, but not limited to: Triple DES, SSL, TLS, or Secure IP Tunneling (VPN using IPSEC). Evaluate viable encryption alternatives for appropriatenesspThe organization employs FIPS 140-2 validated cryptographic mechanisms to prevent unauthorized disclosure of information during transmission across the agency's LAN and WAN. FTI is encrypted when traversing communication lines (e.g. T1, T3, ISDN) using encryption solutions including, but not limited to: Triple DES, SSL, TLS, or Secure IP Tunneling (VPN using IPSEC).SI-2)System Software Maintenance Documentation�Checks to see if the system is kept current with vendor updates, especially security related updates, and that maintenance is received, evaluated, and installed on a regular schedule.�Procedures: Interview the System Administrator (SA) to determine how often vendor software updates, especially security related updates, are received, evaluated, and applied to the system. Review system maintenance documentation if available.fNote: Document here the file names of the databases (or other direct access files) which contain FTI.Note: Document how FTI labeling is done at the table/row/element level. Note: FTI labeling requirements are: a. FTI needs to be tagged at the application, database, data profile, data table, data column and row, or even data element level. b. If an agency has a database that is composed entirely of FTI, labeling at the database level would be sufficient. c. If an agency has FTI commingled with other information in a database, FTI has to be labeled at the level that separates from non-FTI data (i.e. data table, data element).�Note: Document how table / element level auditing is done, what audit elements are collected, and where and how the audit data are stored.�Note: A general rule of thumb for mainframe systems is that the system should be no more than 3 months out of date with regular maintenance. Security maintenance should be applied as soon as possible after being received from the vendor.Update to new template.Booz Allen Hamilton �% SCSEM Subject: IBM i5 OSpan IBM i5 OS mainframe for a system that receives, stores, processes or transmits Federal Tax Information (FTI).I5OS-01I5OS-02I5OS-03I5OS-04I5OS-05I5OS-06I5OS-07I5OS-08I5OS-09I5OS-10I5OS-11I5OS-12I5OS-13Test ExamineI5OS-14I5OS-15I5OS-16I5OS-17I5OS-18I5OS-19I5OS-20I5OS-21I5OS-22I5OS-23I5OS-24I5OS-25I5OS-26I5OS-27I5OS-28I5OS-29I5OS-30I5OS-31I5OS-32I5OS-33I5OS-34I5OS-35I5OS-36I5OS-37I5OS-38I5OS-39I5OS-40I5OS-41I5OS-42I5OS-43Interview ExamineI5OS-44I5OS-45I5OS-46I5OS-47I5OS-48I5OS-49AU-3I5OS-50I5OS-51I5OS-52I5OS-53I5OS-54I5OS-55I5OS-56CM-7I5OS-57I5OS-58I5OS-59I5OS-60I5OS-61I5OS-62I5OS-63I5OS-64I5OS-65Interview TestI5OS-66I5OS-67I5OS-68I5OS-69I5OS-70I5OS-71I5OS-72I5OS-73I5OS-74I5OS-75I5OS-76I5OS-77I5OS-78I5OS-79I5OS-80I5OS-81I5OS-82I5OS-83I5OS-84I5OS-85SI-3Password ControlsIBM default user accountsSite created user accountsAnti-Virus SoftwarePDetermine if automatic session termination applies to local and remote sessions.The System Administrator (SA) will configure systems to log out interactive processes (i.e., terminal sessions, ssh sessions, etc.,) after 15 minutes of inactivity or ensure a password protected screen lock mechanism is used and is set to lock the screen after 15 minutes of inactivity.Systems are configured to log out of interactive processes (i.e., terminal sessions, ssh sessions, etc.,) after 15 minutes of inactivity or ensure a password protected screen lock mechanism is used and is set to lock the screen after 15 minutes of inactivity.uThe vendor-supplied default system administrator account has been revoked or suspended after successful installation.�Review the user accounts report. Determine if the vendor-supplied default system administrator account can be revoked or suspended without adverse affect. Verify the vendor-supplied default system administrator account has been revoked, if possible.�The vendor-supplied default system administrator account has been revoked or suspended. If the vendor-supplied system admnistrator account cannot safely be revoked or suspended, this test is Not Applicable. aAll system-level exits active on a system must be reviewed and verified for authorized changes. �Consult with the system administrator to determine whether the operating system supports site-specific / site-developed exits. If any exits are active on the system, they must be reviewed and verified for authorized changes.�All system-level exits active on the system are reviewed and authorized. Note: If the system does not support exits, or none exist, this check is Not Applicable.�System security is operating in a mode to protect resources, and fail all unauthorized access attempts, including access to resources not covered by specific access rules (default access)..�Review the system security configuration to ensure that resources (files, etc.) are protected, and that the system operational configuration fails unauthorized accesses. (As opposed to ignoring, or merely warning about potential unauthorized accesses.)7The system is configured to fail unauthorized accesses.Tape files are protected.eReview the system security configuration to ensure that resources (files, etc.) on tape are protectedZAccess to libraries containing sensitive system programs is disallowed to general users. �Review the system security configuration to ensure that libraries containing sensitive system programs are protected from access by non-privileged users.PPrimary and backup security files are on different storage volumes / partitions.sConsult with the Information Assurance Manager (IAM) regarding management of the primary and backup security files.FTapes cannot be re-used until all files on a subject tape are expired.|Review the system security configuration to ensure that tapes cannot be re-used until all files on a given tape are expired.iAccess control procedures governing the ability to change the system security configuration are adequate.>Consult with the Information Assurance Manager (IAM) to verify written procedures are established and disseminated to ensure that the ability to change the system security configuration is tightly controlled. Any administrative passwords should be: (1) Restricted to authorized personnel and approved by appropriate systems management personnel; (2) Stored in a secure manner (sealed envelope in a safe, etc.), with access restricted to authorized personnel; (3) Changed after each use; and (4) Their use monitored to detect and log changes to the security configuration.VTasks submitted by a user to run in the background are subject to security validation.Consult with the Information Assurance Manager (IAM) to verify tasks submitted by a user to run in the background are subject to security validation: 1) The user is authorized to submit the task; 2) The user is authorized access to any files or resources used/modified by the task.]Checks to see if the host requires authenitication before being booted into single user mode.�Consult with the Information Assurance Manager (IAM) and System Administrator to verify the system required requires a password when booting into single-user mode.MThe host should not allow booting to single user mode without authentication.`Check to see if the root account can be directly logged into from other than the system console.qConfer with the System Administrator (SA) to verify that the root account ca< n only login from the system console.]The root account cannot be directly logged into from somewhere other than the system console.KVulnerable or unnecessary network services are not employed on the machine.�Work with the system administrator to bring up the listing of services. Verify that unecesary or vulnerable services are not enabled. (may include FTP, SNMP (ok if protocol v3), telnet, rlogin, rpc, etc.)QAll services that are not necessary for the operation of the system are disabled.Configuration IntegritytHave the administrator show the value for the parameter QAUTOCFG and ensure that it's value is set to 0 or DISABLED.LQAUTOCFG is set to 0, thus preventing automatic configuration of the system.System Security Integrity\Type the following command: WRKSYSVAL (*SEC) CFGSYSSEC Verify that QSECURITY is set to 40.`QSECURITY is set to 40, providing sign-on and resource security as well as integrity protection.%Protection of security related values�Use the following command to see if any security-related system values are locked: DSPSECA 1. Enter the STRSST command on a command line. 2. Enter the service tools user ID and password when prompted. 3. Select Work with system security (option 7). 4. In the screen that is displayed, look at the Allow system value security changes parameter 5. An attribute of 2 shows a value to be locked. Locked system values shown on page 73/444 in the IBM i5/OS security guide.[Appropriate security-related values are locked to prevent users from changing those values."Protection against tampered objectVerify the following settings are in place to prevent the placement of tampered objects to the system: CFGSYSSEC - QALWOBJRST has the restore option set to "NONE". Do not allow objects with security sensitive attributes to be restored. - QFRCCVNRST has the restore option set to option 5. Objects that contain sufficient creation data will be converted. - QVFROBJRST has the verify object on restore option set to 5. Do not restore unsigned user-state objects. Restore signed user-state objects only if the signature is valid.dThe system values are set appropriately to restrict the placement of tampered objects on the system."Restricting access to root objectsLQPWFSERVER is set to *EXCLUDE to protect access to the QSYS.LIB file system.QPWFSERVER is set to *EXCLUDE.Security Configurations�Open the iSeries Navigator Click on Security and view the security attributes available and their values to ensure they are set properly in accordance with Publication 1075 standards.(Security attributes are set up properly.2Verifying security via the Security Wizard Reports�Have the system administrator produce an Administrator Information report and examine the recommendations for sigificant security flaws.RThe Administrator Information report does not identify significant security flaws.Object Creation AuthorityyHave the administrator display the value for QCRTAUT to check and see if there are limitations placed on object creation.�The parameter QCRTAUT should be set to either *USE or *EXCLUDE to prevent all newly created objects from being created with a DEFAULT level of authority that is too high (e.g., *ALL or *CHANGE). Attention Key Program protection5Have the administrator display the value for QATNPGM.�The parameter QATNPGM has a defined program assigned to be called if/when a user would hits the ATTN key on a computer or uses a CTRL BREAK to exit an application program.Access Security�Open the iSeries Navigator and expand the Users and Groups option. Examine the users and groups for appropriate settings and permissions.2Appropriate settings and permissions are in place.�Procedures: 1. Identify which sequential access ("flat") files on the system contain FTI (whether solely FTI or commingled). 2. Determine if the naming convention of the files identifies them as containing FTI.�Any special privileged attributes granting hightened system privileges or advanced access to files / resources, are restricted to personnel in a manner consistent with their assigned tasks.�Consult with the Information Assurance Manager (IAM) to identify any special privileged attributes supported by the system security configuration: 1) The function of each privileged attribute; 2) The users assigned each attribute.�Special privileged attributes granting hightened system privileges or advanced access to files / resources, are restricted to personnel in a manner consistent with their assigned tasks.Separation of dutiestVerify that there is no one individual/account that has complete access to all the security functions of the system.oResponsibility for the security functions are given to more than one individual to ensure separation of duties.'Access Protection to Sensitive programsSHave the administrator show that no user has access to the Data ob体育 Utility (DFU).�No users have access to the DFU, which could allow a user to manage and manipulate the contents of data files WITHOUT an audit trail.VHave the administrator show that no user has access to the Source entry utility (SEU).cNo users have access to the SEU, which could allow a user to edit or manipulate source code online.fHave the administrator show that no user has access to the Interactive data definition utility (IDDU).�No users have access to the IDDU, which could allow a user user to create and maintain record formats, data dictionaries (DDs) and file definitions (FDs)aHave the administrator show that no user has access to the Programming development manager (PDM).�No users have access to the PDM, which could allow a user user to select and manipulate objects. Typically, access to this tool should only be granted to programmers.'Access Protection to Sensitive commands�Have the administrator verify that no user has access to the following commands: (Type DSPOBJAUT followed by the command name) DELETE LIBRARY (DLTLIB) CREATE USER PROFILE (CRTUSRPRF) CLEAR LIBRARY (CLRLIB) CHANGE SYSTEM VALUE (CHGSYSVAL) CHANGE DST PASSWORD (CHGDSTPWD) CREATE LIBRARY (CRTLIB) DELETE DFU PROGRAM (DLTDFUPGM) Note: If any user has an access granted higher than *EXCLUDE, have the administrator provide a reason why a user accound would need this capability.IAccess to the sensitive commands are restricted from being run by a user.�Users allowed access to the system when system security is inactive, are limited to authorized emergency, disaster recovery, and systems personnel.#Consult with the Information Assurance Manager (IAM) to determine if the system can be accessed when system security is inactive, and if that access can be limited: 1) If access when system security is inactive can be restriced, it should be restricted to authorized emergency, disaster recovery, and systems personnel.; 2) If access when system security is inactive can not be restriced, then policies and procedures must be in place to ensure that the system is not accessible by the general user community without activation of system security.�Any special privileged attributes granting hightened system privileges or advanced access to files / resources, if assigned to system-level tasks, are restricted to critical, trusted tasks.�Consult with the Information Assurance Manager (IAM) to identify any special privileged attributes supported by the system security configuration: 1) The function of each privileged attribute; 2) The system-level tasks assigned each attribute.�Special privileged attributes granting hightened system privileges or advanced access to files / resources, if assigned to system-level tasks, are restricted to critical, trusted tasks.XAll resources available to interactive users are defined to she system security product.�Consult with the Information Assurance Manager (IAM) to identify resources (files, etc.) available to interactive users: 1) The function / purpose of each resource; 2) The resource is defined to and controlled by the system security product.XAll resources available to interactive users are defined to the system security product._The ability to bypass tape file access controls is restricted to app< ropriate systems personnel.�Consult with the Information Assurance Manager (IAM) to determine if the system supports labeling of files on tape. If it does, then determine if the ability to bypass access authorizations to tape files can be controlled by the security product. If yes, ensure that : 1) The capability to control tape file access is defined and activated; 2) The ability to control tape file access is restriveted to appropriate systems personnel.LOnly appropriate users have the ability to bypass tape file access controls.GUsers are not granted access to the system audit data collection files.nObtain access control list (ACL) for the system audit data collection files from the Security Administrator. �Users are not granted update or delete access to operating system datasets; this access is restricted to appropriate systems personnel (e.g. system programmers / administrators)BObtain access control lists (ACLs) for the operating system files.dUpdate or delete access to operating system datasets is restricted to appropriate systems personnel.EAccess to files containing FTI is restricted to those users required.Obtain access control lists (ACLs) for files containing FTI. Note: If the security product supports a system level capability for universal access (i.e. access to files regardless of the specifications in the file's ACL), the ensure that this universal access does not apply to FTI%User privileges are set appropriately�Work with the admininstrator to bring up the user roles and ensure that roles are assigned with the least amount of privileges necessary to perform their job functions. Verify that no normal user has administrative permissions.VUsers are assigned the least amount of privilege needed to perform their job function.SUser accounts are revoked after three (3) consecutive, unsuccessful login attempts.D1. Have the system administrator attempt to login to the system three (3) times using an incorrect password. 2. Examine the password security settings which control user account suspension for unsuccessful login attempts: CFGSYSSEC QMAXSIGN is set to 3 QMAXSGNACN is set to 2 (disable user profile after QMAXSIGN is reached)�1. User accounts are revoked after three (3) consecutive, unsuccessful login attempts. 2. The system is configured to disabled user IDs after three (3) failed login attempts.�All computer systems must have an IRS-approved screen-warning banner, which outlines the nature and sensitivity of information processed on the system and the consequences / penalties for misuse. ZReview the logon warning banner for information consistent with IRS-approved documentation�Confer with the Information Assurance Manager (IAM) and System Administrator (SA). Have the administrator bring up the auditing parameters. Verify that auditing is enabled: WRKSYSVAL SYSVAL(*SEC) GO SECTOOLS DSPOBJD Also verify that audit logs are not set to be overwriten automatically. This is a finding if a) auditing is not enabled, or b) the audit logs are set to be overwritten automatically.�Auditing is implemented, and the audit logs are not set to be overwritten automatically. Note: This requirement also can be met by the user of a 3rd party auditing tool.!All active resources are audited.�Confer with the security administrator to determine if auditing can be selectively enabled and/or disabled for resources. If selective enabling/disabling is possible, ensure that auditing is enables for all active resources. Have the administrator bring up the auditing parameters and verify that appropriate auditing events are being captured. QAUDCTL WRKSYSVAL SYSVAL(*SEC) QAUDJRN *auditing journal DSP JRN *displays journal informationVAll active resources are audited, and the system logs capture appropriate information.�Confer with the security administrator to identify security related events on the system which can be audited. Determine if these events are audited..�Auditing is configured to capture unsuccessful security-relevant events (e.g., logon failure, user violations). Audit events include the original of request (e.g., terminal ID) for logon, logoff, password change, and user system activities. Each audit event trails the user and information relevant to the event (e.g., date and time of the event, user, type of event, file name and the success or failure of the event). The audit record shall include the file name of the file related event. oRequest that the security administrator generate audit and security reports, including a user violation report.61. Each audit event trails the user and information relevant to the event (e.g., date and time of the event, user, type of event, file name and the success or failure of the event). The audit report records the date and time of the security events, the user, and the type of event/commands performed by privileged users (e.g., user addition, deletion, and modification of user attributes). 2. The violation report records audit events, which include the original of request (e.g., terminal ID) for logon, logoff, password change, and user system activities. 3. The violation reports distributed to and reviewed by the Security Administrator / Security Auditor he violation report records audit events which include the original of request (e.g., terminal ID) for logon, logoff, password change, and user system activities.�Check to see if the organization allocates sufficient audit record storage capacity and configures auditing to reduce the likelihood of such capacity being exceeded.�Interview Information Assurance Officer (IAO) or System Administrator (SA) and ask if log storage is sufficient to meet IRS logging and retention requirements. IRS Publication 1075, section 9.3, requires log data retention for 6 years. Have the administrator bring up the auditing parameters and validate that audit records are kept for a minimum of six (6) years. WRKSYSVAL SYSVAL(*SEC)KSufficient storage is available to meet IRS logging and retention policies.HChecks to see if the organization responds to audit processing failures.~1. Have the administrator bring up the auditing parameters and show the alerts that are set up to notify a system administrator given an audit processing failure. WRKSYSVAL SYSVAL(*SEC) QAUDENDACN is set to *NOTIFY (sends a message if auditing is ended) 2. Interview the system administrator to verify the following actions occur in the event of an audit failure or storage capacity being reached: a. In the event the audit log becomes full, a scheduled job shall be executed to archive the log to a secure location on the server for the Mainframe; it shall include direct access storage (disks) or other media b. In the event the security event log is manually cleared by the system administrator, this should be recorded as an auditable event for future analysis. c. Security event logging should be configured to capture the clearing of the security event log itself as an auditable event.�1. Alerts are in place to notify the system administrator of any audit processing failures. 2.a. A scheduled job is executed to archive the log to a secure location on the server for the Mainframe; it shall include direct access storage (disks) or other media 2.b. Security event logs manually cleared by the system administrator is recorded as an auditable event for future analysis. 2.c. Security event logging is configured to capture the clearing of the security event log itself as an auditable event. OChecks to ensure system time is synchronized with an authoritative time server.a# ps e | egrep xntpd|ntpd # grep ntpdate /var/spool/cron/crontabs/* If NTP is running or ntpdate is found: # more /etc/ntp/ntp.conf Confirm the servers and peers or multicastclient (as applicable) are local or an authoritative U.S. IRS source. If a non-local/non-authoritative (U.S. IRS appro< ved source) time-server is used, then this is a finding.@An authoritative (U.S. IRS approved source) time-server is used.uLogon to the system as a standard (non-privileged) end-user and attempt to generate and view mainframe audit reports.�A standard standard (non-privileged) user does not have the ability to perform system audit functions. A standard end-user is not allowed to use the audit reporting tools. Only Security Administrators have access to these audit reports.\The audit trail shall be protected from unauthorized access, use, deletion or modification. Anonymous FTP is not permitted. Work with the system administrator to verify that anonymous FTP is not permitted. Verify that none of the following exist: -User profile "ANONYMOUS" -FTP server logon exit program [QIBM_QTMF_SVR_LOGON] -FTP server request validation exit program [QIBM_QTMF_SERVER_REQ] �Anonymous FTP is not enisabled. None of the following exist: -User profile "ANONYMOUS" -FTP server logon exit program [QIBM_QTMF_SVR_LOGON] -FTP server request validation exit program [QIBM_QTMF_SERVER_REQ]TEach USERID is unique and is consistent with the naming conventions of the facility.�Have the administrator bring up the list of user account names. WRKUSRPRF DSPUSRPRF DSPAUTUSR QSECOFR is default administrator account. No user should have the same access level as this account.5All user accounts on the system have unique user IDs.>All system tasks / processes are run with a specific a UserID.0Review the list of system tasks / processes with the system administrator. With the security administrator, verify that all identified tasks have a UserID associated with them, such that all access authorizations will be granted by the system security product based on the associated ACL protections. TEach UserID is unique and is consistent with the naming conventions of the facility.�Review the system UserID list to verify that each UserID is unique, and is consistent with the entity s naming-conventions policy.TEach UserID is unique and is consistent with the entity s naming-conventions policy.�Confer with the System Administrator (SA) to verify that devices connecting to the system are identified and authenticated before the connection is allowed.;Checks to see that only valid administrator accounts exist.�Have the administrator bring up the list of administrator accounts. Work with them to ensure that each account has a specific need to be there.PAll administrator acconts are valid and needed for the operations of the system.�Confer with the security administrator to review the system security settings, to verify the configuration for revoking (or suspending) inactive user accounts.CUser accounts that are inactive for a period of 90 days are revokedFChecks to see if password are in-line with Publication 1075 standards.�Have the administrator bring up the password parameters of the system with the command: WRKSYSVAL SYSVAL(*SEC) CFGSYSSEC QPWDLVL If password parameters are pushed down from a group policy, examine those for the same criteria below. -Passwords are atleast 8 characters in length (QPWDMINLEN set to 8 or more) -Passwords are required to be a alpha-numeric combination (QPWDPOSDIF and QPWDRQDDGT) -Password history is set to hold the previous 6 passwords (QPWDRQDDIF set to 6 or more) -Initial passwords are immediately required to be changed -Users are forced to change their password every 90 days (QPWDEXPITV set to 90 days) -Once a password has been changed, it cannot be changed again for at least 15 daysDAll password parameters are in line with Publication 1075 standards.XChecks to see if the default passwords for IBM supplied user accounts have been changed.*Attempt to log in with the following user names and passwords to make sure the default passwords have been changed. You should not be able to log in with any of these. QSECOFR QSECOFR QPGMR QPGMR QUSER QUSER QSYSOPR QSYSOPR QSRVBAS QSRVBAS QSRV QSRV QDFTOWN QDFTOWN(All default passwords have been changed.�Verify that for site created user accounts the default password has been changed. Run the command: ANZDFTPWD The list will show the sensitivity and access allowed by the user IDs.�The default passwords have been changed. The sensitivity and access level allowed by the users are in line with Publication 1075 standards.~Passwords must be a minimum length of 8 characters, with a minimum of one (1) alpha, and one (1) numeric or special character.pReview pasword configutation options and verify configuration of the settings which control password complexity.\Users are forced to change passwords at a maximum of 90 days; 60 days for privileged users..�Review pasword configutation options and verify configuration of the settings which control the password change Interval (maximum password retention period).gThe password change Interval is 90 days For privileged users: The password change Interval is 60 daysKPassword history shall be maintained for a minimum of six (6) generations. xReview pasword configutation options and verify configuration of the settings which control password history retention. 26 generations of previous passwords are maintainedSUsers are prompted to change their passwords 5-14 days before the password expires.�Review pasword configutation options and verify configuration of the settings which control the password expiration warning period.;Background jobs do not have embedded UserIDs and passwords.€Verify with the security administrator that UserIDs and passwords are not embedded in jobs submittied for background processing.TUserIDs and passwords are not embedded in jobs submittied for background processing.�Review pasword configutation options and verify configuration of the settings which control the password minimum change interval. (The password change Interval is 15 days. Interview Information Assurance Offices (IAO) or System Administrator (SA) and ask if any applications or services display the user or service account password during input or after authentication. Have the administrator attempt to log in with an incorrect password.�Interview the System Administrator (SA) or Information Assurance Offices (IAO) to determine if strong (FIPS 140-2 compliant) encryption is used for the authentication module. This includes, sshv2, tls, and 128-bit key lengths. It should not use old/weak ciphers or authentication, such as sshv1, or ssl <=3, or account password hashes that are not hashed using a current standard hasing algorithm, blf, md5, sha, etc. iThe authentication module uses strong (FIPS 140-2 compliant) encryption for all forms of authentication.�Confer with the Information Assurance Manager (IAM) and System Administrator (SA). Verify that interactive sessions (SSH, etc.) are terminated after a period of inactivity in accordance with IRS guidelines.AChecks to see if services that allow interaction without authentication or via anonymous authentication are documented, justified to the Information Assurance Offices (IAO), and are properly secured and segregated from other systems that contain services that explicitly require authentication and identity verification.Determine if the organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission objectives. Examples are access to public facing government service websites such as www.firstgov.gov./Services that allow interaction without authentication or via anonymous authentication are documented, justified to the Information Assurance Offices (IAO), and are properly secured and segregated from other systems that contain services that explicitly require authentication and identity verification.�Check to see if the information system separates user functionality (including user interface services) from information system management functionality.<�Interview the System Administrator (SA) or Information Assurance Offices (IAO) and ask if the information system physically or logically separates user interface services (e.g., public web pages) from information storage and management services (e.g., database management). Separation may be accomplished through the use of different computers, different central processing units, different instances of the operating system, different network addresses, combinations of these methods, or other methods as appropriate.|ob体育s containg FTI are over-written to destroy their contents before the files are deleted (disk space returned for re-use).�Interview the security administrator and the system administrator to determine if the system can automatically over-write a file with random data when the file is deleted (often referred to as "erase-on-scratch".) 1) If this is possible, then ensure that automatic over-write is specified for all files containing FTI. 2) If not possible, then ensure that policies and procedures are in place mandating manual over-writing of files containing FTI before they are deleted.�The system is kept current with vendor updates, especially security related updates. Maintenance is received, evaluated, and installed on a regular schedule. IBM i5/OS is at release v5r3 or newer./Anti-Virus Software is installed on the system.[Interview the System Administrator (SA) to determine if an IRS approved virus scan program in installed on the system. 1. Examine the system to identify the existence of an anti-virus software program. 2. Examine the anti-virus software configuration to verify it is set for automatic periodic scanning, and the virus definition files are current.�An IRS approved virus scan program is used and configured correctly. The anti-virus software is set to automatically scan the system periodically and virus definition files are current.�Note: Document how the default account has been rendered unusable (revoked, suspended or other). Also document if the account cannot safely be revoked or suspended.LNote: Document the system parameters or settings used to control root login.VNote: Document here the file names of the sequential ("flat") files which contain FTI. 8Note: Document the time server used for synchronization.�Note: Document how device identification and authentication is accomplished, and the relevant software and configuration settings (SSH daemon config parameters, etc.).�% DISA STIG for i5 OS�Updated to confirm to the new SCSEM format; added and modified checks for consistency with other SCSEMs Updated for new Publication 1075 version �% SCSEM Version: 1.2 �% Released: February 12, 2013�% NIST Control Name&Full name which describes the NIST ID.hMinor update to correct worksheet locking capabilities. Added back NIST control name to Test Cases Tab.NIST Control NameSession LockAccount ManagementAccess EnforcementInformation Flow EnforcementSeparation of DutiesLeast PrivilegeUnsuccessful Login AttemptsSystem Use NotificationAudit GenerationAuditable EventsContent of Audit RecordsAudit Storage Capacity%Response to Audit Processing Failures%Audit Review, Analysis, and ReportingTime StampsProtection of Audit InformationLeast Functionality8Identification and Authentication (Organizational Users)(Device Identification and AuthenticationIdentifier ManagementAuthenticator ManagementAuthenticator Feedback#Cryptographic Module AuthenticationNetwork DisconnectApplication PartitioningInformation in Shared ResourcesFlaw RemediationMalicious Code Protection SC-8 SC-9*Transmission Integrity and Confidentiality�*颊4��w��+�{撟��c≠�镖?D��X��筮C N {��疥 b��>��唑/鲶F祸�辂1�] �� g��#1]��G P � � � � @# 﨎�5GRJ7O鳸�Z@沖\ 豦�紂}蘹j蟷m,��趮x審*挊鵀sf�� 彚 J��^�� 9��cc��B�� T8�衫,醑{�� d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� od��LetterPRIV� ''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d��?�?�&��cU}$ �}� �}$ �}$�}$ �,;;��h@�@ � �� €��@�@�� z� �� y� �� "�� "�� {� �� |� �� }� �� ~� �� " �� %�� %�� &�� %�� x� �%�� A� �%�� E� �� "�� "�� BX22&222&222222&22222222&22222& �!�"�#�$�%�&�'�)�`*�`+�`� �� !�� !�� "� � "�� #�� #�� $ �� %�F�% �� &�m� &�o�& �� '�n� '�p� )�� *�� +��J�2222 .� 瘊�疴�( � �皙� � �鹉€�A�:?��?€�伱:�The official logo of the IRSPicture 1The official logo of the IRS"瘠┟�PK!�9^�[Content_Types].xml攽AN�0E鱄芰�%NY 剴tA�*T0�'塃2�ち篱� J奙轓斝� v蓐i{郎杬$c娶*%墎睌蹈�2閴�-u銩g�>韤z佣/�3燵0辙嘟還:農5�a青槃8姎�>窯T黹�8W婂�蟫绂>w齇o疁?猘〓潍�Uv_��PK!�+2m��drs/picturexml.xml琔[o�0~煷�`鶟r @%U毸4┷�.榒拓戫&│HU{i蕮}廄}吖欕汣茄�*亭(qx`DE%k&6%个2尨!�&\ Z�挽螫隒� "猇*B`(qk潭饈]荡#鶭n�o#UGl掌��x驱(R_o%祅)5宿僩垤鍌r>�)h吞\�4X雙搽OW捪妈诜贏棱G犹�$J偅薢淲升l0坼h楚i 邡鄏7驂先#�,�翉F{'�&�49堄#�q殾銔3鈶n霜剌酬^ |遷� ��$P/A:�0蠆�� 婓豏$泦U宲腻F�0~}鴫慳喢5X�;餫�轘�栾d鮗'铷wG�卹�薄s渐�輺�/囊庸鞾淥渕讓CuI�W/U磤e5U{)枀j@炚e�9溘.誟ㄙ誉洭!殇貶鑙R諁�(3:攛: he宆`m涄鏅鬬P�0榙Q擿T�荇噎{t鵅迮*眰芨@深NY),潗独梖�膳�0'A}N��?蹡醂��蓛|暛藏嫞t迮羠橥讒豄揍4YN枊�2黭�艵岁殜譱 �7冐盝I-sU晌wCO千�0疠趚翠�>嵳鎖��^獾h�笙e竀嘪嗕�!匭蹻狗N畅乃�a~洤A溓缩yHwL�1 鞬l_|譭��-p咣豀�1C猬+qv g?搅�dg��PK!+芄v�drs/downrev.xmlT怾O�0嗭M��1馧:F6)d!~EA寳蛌�譾iL��顉抻玺9澨:瞻 ZW-犨€∥L^隦纉鵳3婕怨l孎?鑐6郊樔qn秡仜詶寙h7�*镗1�.玃I�3-j��*椹�%檄芤p震0b甦匤򇝼鸑譐犁G蚝Z鳁/檑鼅�|釗KQ堧�.�姹螫�魋N鶤D捍 aJ奭撹�2�t�/�蚵努� 爙3覲�.x/ 嘵�0&粆霕蹻a進蹑榔Gvp破q<屛�(�("槦滝砰��PK-!�9^�[Content_Types].xmlPK-!�ぴ�1_rels/.relsPK-!�+2m��.drs/picturexml.xmlPK-!+芄v�Mdrs/downrev.xmlPK��b pi�]&`��>�@d��w��&&猩陏�寕�K�SafeguardReports@IRS.gov嗌陏�寕�K�Xmailto:SafeguardReports@IRS.govyX侓;H�,俔膮'cカ��''猩陏�寕�K�*http://www.irs.gov/uac/Safeguards-Program嗌陏�寕�K�lhttp://www.irs.gov/uac/Safeguards-ProgramyX侓;H�,俔膮'cカ:''Link to IRS Safeguards ��d?Identify OS or App Version and include Service Packs and Buildsae�X3Insert unique identifier for the computer or deviceBuds�H#Insert tester name and organization ode�O*Insert City, State and address or building� Sheet1gg��\ T8�衫<�u� d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� od��LetterPRIV� ''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d��?�?�&��cU}$ �h�k��k�€k�€k�€k�€k��k ��k �@ �@�@ �@�@�@�@ �@ �@��`�`�`� �H� �� s� �� "�� t� �� u� �� "�� q��q� �r� �� G� ��r�� !� �� oppppptq� �" �% { �;w � 繠�! {@U@�D 繢 �% {@U@ �;w�繠�� J� �� v�zxtq�� I� �� w�nytq�� tq� sssss �� |+~�;w � �PassAZM}�7%��P D�%��B�tq�� | +~�;w � �FailAZM}�7%��F D�%��B�tq�� |+~�;w � �InfoAZM�7%��I D�%��B�tq�� €*��;w � �N/AAZ��tq�� "lmmmmmuq�� sssss� � � �0�222&22&FT�FFP��h&>�@ds��r�w� ��;�€ �� N/AAZAZAZD�%�� ;�€�� N/AAZAZAZD�%�� ;�€�� N/AAZAZAZD�%�� {+{ {+{{+{� Sheet4gg��\ T8�衫!欍嶍/� d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� od��LetterPRIV�0''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d��?�?�&��cU}$ �} $ �}$ �!��€��€��€��€��€��€� �@�@� �@�@�@��@�@��@��@�@��@��@�� %� �� N� �� "�� K� �� L� �� M� �� "�� &� �� ;� � O� �� P�� <� � 6� � �� 7� � Q� �� R�� S�� 8� � T� �� U�� =� � V� �� W�� v� � >� � �w� � X� �� Y�� :� � Z� �� [�� ^�� \�� ]�� @� � _� �� `�� B� X2222&222&2H<HHH<<H<H<HH<H<<<<H �@� ?� � 9� �\�P餒 ��0�( � �>�@d��A �w� Sheet6gg��\ T8�衫 a$�� t,�, d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� oA��LetterPRIV�0''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"A��?�?�&��cU}$ �}��}��}I �}m�}m�}I �}��}�} $ �} �}��}$ �tt �a�@�� 3�� #� � � � B� �� '� C� $�� #�� #� #�#� #>� #?� #@��#�� $�� #�� #� #�� #�� #A� #B� #C� �� #�� $�� #�� #� #�#� #�� #�� #��#�� $�� #�� #� #�#� #D� #E� #F��#�� $�� #�� #� #�#� #G� #H� #I��#�� $�� #�� #� #�#� #J� #K� #J��#�� $�� #�� #� #�#� #L� #M� #L��#�� $�� #�� #� #� #� #N� #O� #N� ��#�� $�� #�� #� #� #� #P� #Q� #P� ��#�� $�� #�� #� #�#� #R� #S� #R��#�� $�� #�� #� #�#� #T� #U� #T��#�� $�� #�� #� #� #� #V� #W� #X� ��#�� $�� #�� #� #�#� #Y� #Z� #[� �� #�� $�� #�� #� #�#� #\� #]� #^��#�� $�� #�� #� #�#� #_� #`� #a��#�� $�� #�� #� #�#� #b� #c� #d��#�� $�� #�� #� #�#� #e� #f� #g��#�� $�� #�� #� #�#� #h� #i� #j��#�� $�� #�� #� #�#� #k� #l� #m��#�� $�� #�� #� #�#� #n� #o� #p��#�� $�� #�� #� #�#� #q� #r� #s��#�� $�� #�� #� #�#� #t� #u� #v��#�� $�� #�� #� #�#� #w� #x� #y��#�� $�� #�� #� #�#� #z� #{� #|��#�� $�� #�� #� #�� #�� #�� #}� #�� #�� $�� #�� #� #�� #�� #�� #�� #�� #�� $�� #�� #� #�� #�� #�� #�� #�� #�� $�� #�� #� #�� #�� #�� #�� #�� #�� $�� #�� #� #�#� #~� #� #€��#�� $�� #�� #� #�#� #�� #�� #��#��D�l.�~�~~~~~~~~~~�~~~~~~~~~~~��~ �!�"�#�$�%�&�'�(� )�*�+�,�-�.�/� 0�1�2�3�4�5� 6� 7�8�9� :� ;�<�=� >�?�� $�� #�� # � #� #� #�� #�� #�� #�� !$�� !#�� !# � !#�!#� !#�� !#�� !#��!��#�� "$� "#�� "# � "#�"#� "#�� "#�� "#��"��#�� #$� ##�� ## � ##�##� ##�� ##�� ##��#��#�� $$� $#�� $# � $#�$#� $#�� $#�� $#��$��#�� %$� %#�� %# � %#�%#� %#�� %#�� %#��%��#�� &$� &#�� &# � &#�&#� &#�� &#�� &#��&��#�� '$� '#�� '# � '#�'#� '#�� '#�� '#�� '�� ' #�'�� ($� (#�� (# � (#�(#� (#�� (#�� (#��(��#�� )$� )#�� )# � )#�)#� )#�� )#�� )#��)��#�� *$� *#�� *# � *#�*#� *#�� *#�� *#��*��#�� +$ � +#�� +# � +#�+#� +#�� +#�� +#��+��#�� ,$ � ,#�� ,# � ,#,#� ,#�� ,#�� ,#��,��#�� -$� -#�� -# � -#�� -#:� -#�� -#�� -#��-��#�� .$ � .#�� .#� .#�.#� .#�� .#�� .#��.��#�� /$� /#�� /#� /#�/#� /#�� /#�� /#��/��#�� 0$� 0#�� 0# � 0#�0#� 0#�� 0#�� 0#��0��#�� 1$� 1#�� 1# � 1#�1#� 1#�� 1#�� 1#��1��#�� 2$� 2#� 2#� 2#�2#� 2#�� 2#�� 2#��2��#�� 3$� 3#�� 3#� 3#�3#� 3#�� 3#�� 3#��3��#�� 4$� 4#�� 4#� 4#�4#� 4#�� 4#�� 4#��4��#�� 5$� 5#�� 5#� 5#�5#� 5#�� 5#�� 5#��5��#�� 6$� 6#�� 6#� 6#�6#� 6#�� 6#�� 6#�� 6�� 6 #�6�� 7$� 7#�� 7#� 7#�7#� 7#�� 7#�� 7#��7��#�� 8$� 8#�� 8#� 8#�8#� 8#�� 8#�� 8#��8��#�� 9$� 9#� 9#� 9#�9#� 9#�� 9#�� 9#��9��#�� :$� :#�� :#� :#�:#� :#�� :#�� :#��:��#�� ;$� ;#�� ;#� ;#�;#� ;#�� ;#�� ;#��;��#�� <$� <#�� <#� <#�<#� <#�� <#�� <#��<��#�� =$� =#�� =#� =#�=#� =#�� =#�� =#�� =�� = #�=�� >$� >#�� >#� >#�>#� >#�� >#�� >#��>��#�� ?$ � ?#�� ?#� ?#�?#� ?#�� ?#�� ?#��?��#��D€l~~~~~~~�~~~~~�~~~~~~~~�~~~~~~�~@�A�B�C�D�E�F�G�H�I�J� K�L�M�N�O�P�Q� R�S�T�U� V� W�X� Y� Z� [� \� ]� ^� _� � @$!� @#�� @#� @#�@#� @#�� @#�� @#��@��#�� A$"� A#�� A#� A#�A#� A#�� A#�� A#��A��#�� B$#� B#�� B#� B#$� B#;� B#�� B#�� B#��B��#�� C$%� C#�� C#� C#� C#<� C#�� C#�� C#��C��#�� D$&� D#�� D#� D#�� D#:� D#�� D#�� D#��D��#�� E$'� E#�� E#� E#�� E#:� E#�� E#�� E#��E��#�� F$(� F#�� F#� F#�� F#:� F#�� F#�� F#��F��#�� G$)� G#�� G#� G#�� G#:� G#�� G#�� G#��G��#�� H$*� H#�� H#� H#�H#� H#�� H#�� H#��H��#�� I$+� I#�� I#� I#�� I#:� I#�� I#�� I#��I��#�� J$,� J#�� J#� J#�J#� J#�� J#�� J#��J��#�� K$-� K#�� K#� K#�K#� K#�� K#�� K#��K��#�� L$.� L#�� L#� L#�L#� L#�� L#�� L#��L��#�� M$/� M#�� M#� M#�M#� M#�� M#�� M#��M��#�� N$0� N#�� N#� N#�N#� N#�� N#�� N#��N��#�� O$1� O#�� O#� O#�O#� O#�� O#�� O#��O��#�� P$2� P#�� P#� P#�P#� P#�� P#�� P#��P��#�� Q$3� Q#�� Q#� Q#�Q#� Q#�� Q#�� Q#��Q��#�� R$4� R#�� R#� R#�R#� R#�� R#�� R#��R��#�� S$5� S#�� S#� S#�S#� S#�� S#�� S#��S��#�� T$6� T# � T#!� T#�� T#�� T#�� T#�� T#��T��#�� U$7� U#�� U#� U#�� U#�� U#�� U#�� U#�� U�� U #�U�� V$8� V#9� V#� V#�� V#=� V#�� V#�� V#��V��#�W� W4�W(� Z�$� [�� \� � ]�� ^�� _�D�l~~��~�~~~~~~~~~~��6` � � ` �"��饊0� 餳�( � �餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C��]F!d ��Z餜� � C�� ]F !d ��Z餜� � C�� ]F !d ��Z餜� � C�� ]F!d ��Z餜� � C��]F!d �>�@Z�� A �w�V V ��;�€V d ��*��Pass��;�€V d ��?��@Fail��;�€V d ��Info{+{V {+{V {+{V ��/ %[^V �/ %_`V� Sheet2gg��\ T8�衫丂5G d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� od��LetterPRIV�0''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d��?�?�&��cU}$ �} $ �}$ ��€��€��€��€��@ �@ �@��@�@�@��@�@�@�� (� �� )� �� a� �� b� �� c� �� "�� €� �� .� �� d� �� e� �� f� �� -� �� ,� �� g� �� h� �� i� �� j� �� "�� *� �� +� �� k� �� l� �� "�� 4l�222222&22222222222&2222>�@d��A �w� Sheet7gg��\ T8�衫鳲T d褚MbP?_*+�€%��# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S飥� od��LetterPRIV�0''''��0\KhCFF燆��SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d��?�?�&��cU}$ }mT}m��k�� 2�� /� �0� �1� �D�$@纅鉆� 5� ��?@煦@� �� 殭櫃櫃�?~ �銨� !�� ^@��,銨� '� �� "� �� 0��822<2 �P餒@��0�( � �>�@d��A �w� Sheet8gg��\ �鄥燆鵒h珣+'迟0�hp�� IRS Office of Safeguards SCSEM$IT Security Compliance EvaluationBooz Allen Hamiltonusgcb, stig, pub1075�The IRS strongly recommends agencies test all SCSEM settings in a development or test environment prior to deployment in production. In some cases a security setting may 爄mpact a system抯 functionality and usability. Consequently, it is important to perform testing to determine the impact on system security, functionality, and usability. Ideally, the test system configuration should match the production system configuration. Prior to making changes to the production system, agencies should back up all critical data files on the system and if possible, make a full backup of the system to ensure it can be restored to its pre-SCSEM state if necessary.Michael CarusoMicrosoft Excel@€/p+彝@鈙樛@(l裬 ��胀諟.摋+,D胀諟.摋+,�@`h|�� securityOffice of SafeguardsInternal Revenue Service DashboardResults InstructionsTest Cases AppendixChange LogAppendix!Print_Area'Change Log'!Print_AreaDashboard!Print_AreaInstructions!Print_AreaResults!Print_Area'Test Cases'!Print_Area'Test Cases'!Print_TitlesWorksheets Named Ranges�0v~��_PID_LINKBASE_PID_HLINKS_NewReviewCycle�AThttp://www.irs.gov/uac/Safeguards-ProgramA*http://www.irs.gov/uac/Safeguards-Program7 mailto:SafeguardReports@IRS.gov !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€�� !"#$%&'()*��,-./012��456789:��Root Entry�� F��Workbook��USummaryInformation(��+DocumentSummaryInformation8��3