��>� ����d�����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abce���fghijklmnopqrstuvwxyz{|}~Root Entry�������� �Fvz�`i�#Workbook���������MsoDataStore �iiB���L2JA�E���DKK�B��5Q==2���������iPiItem ���������Properties������������OJ���G�0���OB4TVLRH�5��==2 �iiItem �������� � Properties������������Am�P�FO2E��U���CI�1��3��==2�������� �iiItem ���� ����O_Properties������������]l ZO������\pAlobaidi, Ruda [USA] B�a�=   � ThisWorkbook���=��pY.8�@�"��1���oArial1��oCalibri1��oCalibri1��oCalibri1���oArial1���oArial1���oArial1���oArial1��oArial1���oArial1���oArial1���oArial1���oArial1� �oArial1���oArial1���oArial1���Calibri1� ��Calibri1���Calibri1�4��Calibri1� ��Calibri1���Calibri1���Arial1���Calibri1,8��Calibri18��Calibri1�8��Calibri1� ��Arial1�>��1�4��1�<��Calibri1�?��Calibri1h8��Cambria1���Calibri1� ��Calibri1���Arial1���Arial1� ��Arial1� ��Arial1���Calibri1���Calibri1����Calibri1 ����Segoe UI"$"#,##0_);\("$"#,##0\)!"$"#,##0_);[Red]\("$"#,##0\)""$"#,##0.00_);\("$"#,##0.00\)'""$"#,##0.00_);[Red]\("$"#,##0.00\)7*2_("$"* #,##0_);_("$"* \(#,##0\);_("$"* "-"_);_(@_).))_(* #,##0_);_(* \(#,##0\);_(* "-"_);_(@_)?,:_("$"* #,##0.00_);_("$"* \(#,##0.00\);_("$"* "-"??_);_(@_)6+1_(* #,##0.00_);_(* \(#,##0.00\);_(* "-"??_);_(@_)� m/d/yyyy;@,�'[<=9999999]###\-####;\(###\)\ ###\-####�0.0�"Yes";"Yes";"No"�"True";"True";"False"�"On";"On";"Off"]�,[$� -2]\ #,##0.00_);[Red]\([$� -2]\ #,##0.00\)�� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� � � �� ff��� � +� �� � )� �� � ,� �� � *� �� �� �� �� �� �� �� �� �P� �� �P � �� � � �� �� �� �� ���� �� �� � � �� �`� �� �� � � � � � � �� � � � � � � �  � � � ���� � � �� �!� �� �"� �a>� �#� �� � @� � � �x� ��4��� �4��� � � � ���� � x? �7 � x@ �7 � x��7 �x? ? � �x@ ? � �x�? � � x? @ � � x� � x�@ � � x@ �� � x��� �x� � x? �� �x��, �p��, � ���� �  �@ ? , � � �  �, �  �, �  �, � �? �, �  �@ �, ��? ?  ��@ ?  � �? @  �� ��? � ��@ � ��? �7 ��@ �7 ��? �� ��? �, ��@ �, �$�@ �� �$��@ �� ��@ �, � �@ �7 � ���7 � �? @ � � �� � ��@ � � �@ �� � ���� � �� � �? �7 ��? �, ��@ �, ����, � �� ��? ?  ��@ ?  ���?  � �? ? � � �@ ? � � ��? � ��? � ��@ � ���� � �? �� ��? � ��@ � ���� � �? �� � �@ �� � ���� ��? @  �� ���@  ����, �  � � ��?  � �� � �? ? , � �? @ , �$ �? @ , �  �� �  �� � 8��� � � 0��� � �� 4��� � � 4? �� � � 8��� � ��4��� � �4? �� � �0��� � �8��� �4? �� �  8��� � � �$<? �� �$ 8��� � � �  �@ ? , �  � , �  � , �  � , �  �@ �, ��@ ?  ��  ��@ � � � � ��@ �7 �%�@ @  ��@ �� @ ��@ @  ��  ��@  ��  ��  � @ @ � � @� �  @� � x@ @  � x@ @ , � x@, � x @, � ` � � x@ @  � x@ @  � `@ @ 7 � x@ @  � `@ @ 7 � x@ � � x@ � � x@ � � `@ @  � x�@ , � x�@ , � x? @ , � x@ �, � x��, � x? �, �  � �x@ @  �8@ @ � �8@ ? � �8�? � � <�? � � <? ? � � 0 � � (� � x@ @  � @ @ � � x@ , � x � 8@ @ � � x@ @ � �  x@ @  �  (@ @ � �"<@ @ � � @ � �  � �x � �  � ��@ @ , � � � �� � ��@ @ � �8@ @ � �8@ @ � � |@ @ � ��@ �, � �@ @ � ���� ��? � ��? �� � � �"8@ @ � �& H �' H � @ � �@ @ , � �@ �7 � �@ ? 7 �  �@ @ � �  � � �� � � � �� � �� ��@ @ 7 � � @, � � �� ��� �  �@ @ � � 8@ @ � �  x@ @ � � � ���� � � 8��� �� 4@ @ � � 4@ @ � �  8@ @ � � � @ � � � � � � � � ���� � �? �� �  �? �� � � �? �� �$ �@ �� �$� �@ �� � �� 4@ @ � � � 4@ @ � � �8@ @ � �"(x@ @ + �(*x@ @ + �)x@ @  �)*x@ @  �)x@ @ � �(p@ @  �)x@ @  �*p@ @  �*x@ @  �**x@ @  �p@ @  � � � `@ @  �)*8@ @ � �"0@ @ � � @ @ � �  �@ @ � �  �@� �  � @� �  �@ @ � �  �� �  � � �  �@ � �  � � �  � � � �? ? � � �@ ? � � ��? � � �? @ � � �� � ��@ � � �? �� � �@ �� � ���� ||=}A} 00_)ef[$� -}A} 00_)ef[$� -}A} 00_)ef[$� -}A} 00_)ef[$� -}A} 00_)ef[$� -}A} 00_)ef [$� -}A} 00_)L[$� -}A} 00_)L[$� -}A} 00_)L[$� -}A} 00_)L[$� -}A} 00_)L[$� -}A} 00_)L [$� -}A} 00_)23[$� -}A} 00_)23[$� -}A} 00_)23[$� -}A} 00_)23[$� -}A}  00_)23[$� -}A}! 00_)23 [$� -}A}" 00_)[$� -}A}# 00_)[$� -}A}$ 00_)[$� -}A}% 00_)[$� -}A}& 00_)[$� -}A}' 00_) [$� -}A}( ��00_)��[$� -}�}) }�00_)�[$� -�##0.� � �}�}* 00_)�[$� -???�##0.???� ???� ???�}-}/ �00_)}(}0  00_)}A}1 a�00_)�[$� -}A}2 00_)[$� -}A}3 00_)�?[$� -}A}4 00_)23[$� -}-}5 00_)}(}6  00_)}�}8 ??v�00_)�̙�[$� -�##0.� � �}A}9 }�00_)��[$� -}A}: e�00_)��[$� -}-}= 00_)}x}?���00_)���[$��## �� ��}�}@ ???�00_)�[$???�## ???�  ???� ???�}-}B 00_)}U}C 00_)[$## }-}D ��00_)}(}Y��00_)}(}Z��00_)}(}l��00_)}(}m��00_)}(}n 00_)}(}o 00_)}(}p��00_)}(}z��00_)}(}{��00_)}(}|��00_)}(}~�00_)}(}�00_)}(}�00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}���00_)}(}� 00_)}(}� 00_)}(}� 00_)}<}� 00_)�[$}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}��00_)}(}�00_)}(}���00_)}(}���00_)}(}���00_)}(}�00_)}(}��00_)}(}��00_)}(}�00_)}(}���00_)}(}���00_)}(}���00_)}(}���00_)}(}���00_)}(}���00_)}(}�00_)}(}���00_)}(}�00_)}(}�00_)}(}���00_)}(}���00_)}(}�00_)}(}�00_)}(}�00_)}<}� 00_)[$}<}� ��00_)[$}(}�00_)}(}���00_)}(}��00_)}d} �00_)�[$ �## �???� }(}00_)}(} 00_)}(} 00_)}A} 00_)4�[$ }A} 00_)4�[$ }A} 00_)[$ }A} 00_)[$ }-} 00_)}(} 00_)}A}! 00_)[$ }(}"00_)}-}#_)}-}$_)}(}%_)}(}'_)}-}( _)�:� ���� ����%�9� +��� � !%�9�  �� ?333� !%�9� � *�� !%�9� +��� � !%�9�  �� ?333� !%�9� � *�� !%�#� ����%�#� ����%�9� +���  �� !%�� ������ ����� 20% - Accent1�M�� 20% - Accent1 ef� �%� 20% - Accent2�M�"� 20% - Accent2 ef� �%� 20% - Accent3�M�&� 20% - Accent3 ef� �%� 20% - Accent4�M�*� 20% - Accent4 ef� �%� 20% - Accent5�M�.� 20% - Accent5 ef� �%� 20% - Accent6�M�2� 20% - Accent6  ef� �%� 40% - Accent1�M�� 40% - Accent1 L� �%� 40% - Accent2�M�#� 40% - Accent2 L� �%� 40% - Accent3�M�'� 40% - Accent3 L� �%� 40% - Accent4�M�+� 40% - Accent4 L� �%� 40% - Accent5�M�/� 40% - Accent5 L� �%� 40% - Accent6�M�3� 40% - Accent6  L� �%� 60% - Accent1�M� � 60% - Accent1 23� ����%� 60% - Accent2�M�$� 60% - Accent2 23ږ� ����%� 60% - Accent3�M�(� 60% - Accent3 23� ����%� 60% - Accent4�M�,� 60% - Accent4 23� ����%� 60% - Accent5�M�0� 60% - Accent5 23� ����%�! 60% - Accent6�M�4� 60% - Accent6  23� ����%� "Accent1�A��Accent1 O� ����%� #Accent2�A�!�Accent2 PM� ����%� $Accent3�A�%�Accent3 Y� ����%� %Accent4�A�)�Accent4 d� ����%� &Accent5�A�-�Accent5 K� ����%� 'Accent6�A�1�Accent6  F� ����%�(Bad�9��Bad ��� ���%�) Calculation���� Calculation �� �}�%������ ���* Check Cell��� Check Cell �� ����%�???��???��???� �???��+�� ��Comma�,��(�� Comma [0]�-��&��Currency�.��.�� Currency [0]�/Explanatory Text�G�5�Explanatory Text ��%�0 ��F� �Followed Hyperlink  �� 1Good�;��Good �� �a�%�2 Heading 1�G�� Heading 1 I}�%O��3 Heading 2�G�� Heading 2 I}�%�?��4 Heading 3�G�� Heading 3 I}�%23��5 Heading 4�9�� Heading 4 I}�%�6��4�� Hyperlink  ���7 Hyperlink 2� 8Input�u��Input ��̙� �??v�%������ ���9 Linked Cell�K�� Linked Cell �}�%���� :Neutral�A��Neutral ��� �e�%���"��Normal� ;Normal 2�< Normal 2 2�= Normal 257�;��� Normal 257 �%� >Normal 3� ?Note�b� �Note ���������� ��� @Output�w��Output �� �???�%�???��???��???� �???��A��$��Percent� BTitle�1��Title I}�%� CTotal�M��Total �%O�O��D Warning Text�?� � Warning Text ���%�X��TableStyleMedium2PivotStyleLight16`� Dashboard�arResults� � Instructions� � Test Cases� Change Log�Issue Code Table������&!  ; �_xlfn.COUNTIFS  ;   ;,  ;&   ;   ;   ;���5�f~fhH�('@������ @Z$�5b�-!ODw�30@Gbe� n�!ODw�30@Gbe�PNG  IHDR��<q�sBIT|d� IDATx^}`�`SJsH� JH��"�� btJww� `�ynw]^O�9��f�3 o�7��𿴾gN��3�R+[V]ò2 -EcYt�޸!V66�+�-{mUu?RN}>_:ϭ��՛ֳ*ի�d~=qك۽rn}L=Q")))�,g%6�$.�(~f8x|G�=1�%1� "�;KaL!w�8يZdy(%,"ZB�f鴵�(�4\JV--� 8+x9|�o�=y�w�Oևo1|WF�o�9�h4�dqp56kWP�8>�7J( })�'�$8\�t�"\&�{r9|)��4� �JSkW�MjJBve |�>xW�?�3_T;F� ߶3>�b'{�j�-&VK)X�ܒ�[wBD86Xۊ�NORK�,"�*JK�z[6,goóIF7x�,bڮ~)w�-έf0�aC[cwnݱHGbo^rΓƠw @?�"�< /7�*kTK7e+600hG�K/)Xj\�Ir�`7VFd �0�|˗0o[мl�;�޻u3~�Y�+�#�#� ݈Je�-N�J�*"ݛ֔ƕ}�&0X ��!%?��"�c6^^^jR]J�|K�8gK keeج_)eݬ�tTz�_XAz ��VWӻE-�� f|rJH�1�9&UDG�.LXDI${J�30� o"Ψ"zɪ}`2E]Wz-%��;Yj�?`}ŔwX�#Io�G�>m e�ŻO�0q{He,H}Hs$M^xa�RT�2u�YuB�:DY:i_�#?�;� �CG�-C`סO/spC�nO� �5�� ~`_o]Gɗv�"� ^żd\צҶ{>�?�Հ܉�5~vyd~D7Gt���1痲sH~uwC:K�e\x+D⁰仡]doP_Kh$Rĭ{V�;ӆu.�2%�FZV/'�% ˹γWeEnߌF� ߢ^i߶1Xg!Oi ^� ],&Z׷uW|g[��kko^3cuDBy�䎋c^򍪚�$ٓ$fljK2 {K@�=yB bSI��ݭj�4Ho �M�� �7tl�+I�]'eڢmK�:34�5P�5g 8}LEloun탽l'�01�1XO�%R`~C)T4j�6`9�kE�r$X}Pa\Zש$H(I cz�8߮إmS} zH �1yVvd[=q�3�@ӍQnT�.zL��M!L�?t�8w�9� o =n�I̝w0_�k�;#|O�:sAS{:h|ч�ZV/+-G� �dJ�2/�&>nW� Zʜ-G��,<0ƯS,9�$r%t_E zs�,�>tml�+f�|%_ D�>⵼N� �6�?O�?Q � U;PA2 R� � xH�"}ֿ8Y� **�!mGȗ)Xv�9�;[��2 �lCsӹVB�+N?�0]���.]~ÜU*�&0 JDRP|hkeܜ `Rcf�>$ɪ�7<�+A�e 0G2�$�;Ag�2HI�9)Cț~ue)ɛ~�% ϟfB� x�%> �soL�=yDAwym]��0Mo�* �;^AV}4@�y%�$_k�n�)nBa`X�*rGvLIaZ7MeΓr;ުƁew�i� G�k@�?(6lĈ>[� � �:@d�ߍ_̇J�ud�|`�2CFK~r� כ߭�C7qd7iS'iO]xG~B/-xݨ_'�tq/ �: 76wɟkk&%мO_H�_)otCw%y�rn(�3��5GA��,ÿ[.Q5Q�7 #z1oP/_ݓ^ع}{G_Wuym���fK�>oLӘs�,z`�K0St@_TGb1M)C�(� DB�? U[�+H �H)W�&��rD!w�zC'E,jQ�!|�@~X3Jj�8ove�qr-5�'k{N�;u`BD�0w|6�&�_/HLQEz6�)Vմ�ѷP�E�Gk�8:L`Xxn�7�*�-ںx�:�?`06ʖ/�]��JBݦU�:o;(c�0�25^5ߐW^H�X]o��+Z~[� L2}r ׃GO���ltc!�9�pŰ�>*@H%kPH�i�pA%�� oՓmWI~.͔ݫxm3sp2 s5=Z~m7�-'/hX �0/Э�GMv}9Đz_�H�7.�x|˄ߍPmCiiX~z~e$��5 篷�+vK �,� �8.O� @/eL�L:mkWP� )gYI4 ͰNV]J� <4(� yHcown,�Ki�KR.S�%CA|X/ʬ]�"ƮN=�e 4�Bk�ۦC�mQsos��Y rd�CgL͸�7b-\�w,1ֵ g_C�&i]cPH.s�)\�,H_� ` `d?6J0R<� `�>E Hf{p0g+x|Wl�9w&�P#0Y�):4�&�t�/ޒU�x`�p KƆH�:C�̃D�% B�6��5gn/�zbAf�> rfҤ 5�QGkeJV=y�w̍:@?Co2A0ߏzECs=5�vxz/(sL8e{N� �5lXouUy$]J�>г�m�$&��.@=>�+� e㴑pV,/Ni�4�6�!opu�1A#�6hվ�Yk!^>x+�?g찭S�g&� >k˼AV#�5\=n� �,� `jF_l^Sz4�.;ay~860K�H[��gK^�?�10zai ,X`�g+��~� !T@=%__ӄ)�0.MgJ�?{w_� md�� �%d|?Tω�4W��&fv򛡆5kWOMҼV�`|Ń94ss�1�Xbk�3Ǒ%;a�A�*A�)�>~]jJ2|5rQ NP�<s�4Dn�~�(�& s� T/n{~փLZkO� �tGY�}:hCy�>}ʲ��,尪P?$ڲT2mնĹ�;帿7ρ%綊�<\M:N��އ\�)g�� m��!M}�*ǻa^&� Cwlp h�:M&i <1T0,٥�0h%=�}jwJ-�>�܌W.�~ܨջN)�TSL_eI󷾕4T�+�(.(JVOck>[� &~}@vE�-&>�SkZU;Gk|Oy.^-_}�/�.7�{�2 \ƞ#�QJϵ�RuVzg7� �,� 'Icp\�>{3�1݇Ӂr²Ѳֽ�|5ea'�;+价�!97�WQ͚:j�9�=� �9Hh�#Eo �Q5cJ?q7�$__ >tik>}�֣�6�ʶ!�+7��Mcҋڜa�""=YbHD�~:�,?wE )x"`��3QitOU|�*Za(�t(� I�يfsI[ݣ?H Caֿ>V |38c�({�7SB#˱fKZu�x�=IdkOADtuiL_M`7(� F0Q.bJM@� �8Jp�#iN5f dv_ ܼf-to![(d�%B=?~�$a�b�夡Sߕ [g EKֽkbw5oڜrq߹V@G߁;pdP'�W�3 V\֧\p� j`iûɅ[e1kUJ!|>� � =m*˟̼60oT~[`�GX#HJE�9�/,��*`Wf�$�zl(,� Ow�z<�ȑrꮭ| @/faj>p�6+`,.J z_U]j�2�!O0q1�CpVG>@o&�wpi ';b%�'Vi-� l�?{쫈<(|1Q5*�+� i|֭�Sޘ�A8�>R�Ɉ�1�R� ݧ�%H}V陫a*mհ� zIzFH�$2ZL�6~怖If{Š�Lep[I�<@gx`Mn·!ǾX�b+uCױqɺ8YFá� Kf# `yW+FGm5�d`0D?I3䑘ۿrUk|qNrg潨O1O�'e\D4VC]'ĽG��1Wb@\ ʋR &�A*]�=��!u �JcxN�6Q� �9SwT�--M�ǟB�>[ϲ�4`���ک5��3KUG^�sr� 4h�$N=-HR_W�$խ˹qS�n8BƊ]�ⅲ޲R�%֫y�c�6CJMm�-_{懳�'җz] 1~A |P ;XrZ#�?oE�``]W�4H^vN7K�.�*wFJ26~k9n ci.f�6ۼ�:ㇿ&VMP{U�- $ރZn=0^׶miKfu]uٻcۢ^wm[ґ�݉.C-�:Ȓـ &A@g u9ɌS�)�:D*<��`mFzZD.Ŗr)�(Kwkr3Sj��9z�sx*�>xKL � KBwlq2s IDAT�bch͜{i}�DYr��/lf�`q1t&yU lBH͂� Cjmrŭw:]�@]V@N3�)y �xO@�8�T\2�H�4gx br=8W�/'ۏ>*� qN�oD=AD�ebk�.LOt� �,X��-%@��R�9nx�$ޑB�#I׃?@ouz5Z� �#zo.KW\rbwxS̿�e"߱W!FKcXU ��2q� Sgl`b�%�mҵ��)5�%[[9񤸜�,)�Jky�7ڋUJ<ɮ[� mfRiZI6R�)Rk Ћ{CR{]�$�%%�*Xiy_��'� ݑ̿귕:zicD{� Z�5�0y` ��zOI󄎎Oq_�O[~¯fq�2?a�܍��(=CmA�J-np6WQ�: k�/�B�ztDc Ⱦ� e&=]D� qf֑g�%,G\]�AqDL�EnBU��)|VѮކ.aY4y6|l�@ɭHjyJ �;ҥ�5U�>dycjjgeR Pf��S LBZ�('�9�1iCn u.JPa�/�;�<~� � /5�&{d�kgY)\`jlBJ�]͸ nlKd֬QVܯ.}_�G�3�X�-�+N5o_Olh b �%Pa֯Jo~6lhՁX@Y'�5lUd��2L{g)}A<~'�z�2$#�<-j*BPT�$u{\k�9~űe�iK{J�0�5ԯrq/Cc/E`鮙� k~E6�29DiE# FE�!jee#n]Urc {� �&e�>H x&p{�jy)�3褴ǪJ~ӽK�M?S�0y)��hhfCus̪YUN� lK#J.zg��,Bq}ە0��6T\�']ʑ�8Y;],'�$eYڥrj ì -Y1ݸAI^��1Rʧ앣jQ�w;W5C%61EJ#-LjRyhI�6lϰE��:�Y�3�&Bk =^߭ | H =N*r�*mՂr/aNhf�2� EsoGWe�4 s~|~ t`ːkB�62v�á���ǰ0GR�'n]!wo#�&� Ą�6^!JUF<* P�3D.+U�V&�5= �+�4h\�Mmj!�W� g�12s�*\#Ћt��";�5�S�l1֑o>~Eg�(S,reל@Rm�-`&@�uИAQ�(l�7ێp3z,eZ?*;Y��+S-��&Hj^ҿF xjY�pÙƞs�:_,}%A~ ,�'ˁ�eWW֫�/wQ:= I�=R�>g.l�:��=ͦKQdP/2kf ]U,�5><#؁J̴ͤ9OU�bKRIu6I rH<s�35`@l�Hy\[H]q?v�.7_$� M˪넒�ZKI4+�6 vRf58AO3OJW�dnVՕ�#a"L '} qr�cunצZll LO�#�n�'gZ&v�� 5`�SbxY}Rb� t^ ߇q�ZԮ)�.A�0l;N(a5w�+�-� �6[KU� PqB%�-bX��43� v�-V�>}\Sz ϗ y 8y1�;58&T� @� bL׺b3f*�?o;�.Cn,… eJBRZ)CL� Ľ�,y*�%�=H_�>J%}Pf/�"iڳ!8]�9_ݺ[ԼZ�}kXoV�T5^�=;o[[4Q� cn*ŒPuF/j=|[miQD2S�){�4y��*2�K�~eldZ�$,k $p{t̩U  y]t[iKB͊ff�!.B@�;�&6vt'Z_L_y�^�`� y��׬]ccVEUĻPS耭>s�>N`R�3}Sx+fݑH~erbKG0� *?0�.^O �[$2) ̫b\qez ki�;gzK!yGrB]�/4lu(�0UXZ�Nsv͝2BkkeəP�5AfGF� ?AءR GZ �;N+3m僣�a�0Rj�,-EY �oX�;Z'X{kI c_Δ@H=X˔@�ԉ]&�*Cn$!>b`�Ɗ@�L�S[�!Fc*m� Dnar0X P%P �[+ ˫X�?ӻ�Zˎea\n� ض�/�6u7դ�7u��?Y�>oXFy^?sdL\C1 �8Qy�4+CWbFæK=W�<�8R>ޜ2|Jڸl�,J% d,.6GScM�0� :Ex11`�\wpaH ��Ҡb)9q%H�-Kg{ �0P�pƇ#!�W}�� BNZŅ k�#_s0 k�uL76 [�Y*&�9P�( gj6�&TWSI�24ws�{�>󴥘?< ǵ€ 7a bt~X$v��b\\ ,4kEUulf5�s�`�,d%�(oY #,@.wϷjJG�'Jg �< ǰ�!8�:�+�sR@� �!@I�2cn�' �]�:,p� ��!ϵ~'^E/멐-�0X`�Lflu �M�+L֗Fe62n E�4�/<ɝx5u�du"�78jN�}��3ve&q݊u+~��NUeHrLEjtoB� JzZ�1ٔ۴�,U�" KJBB�( {!O+":IA2ֺիSF?�'x S`@'xF_sQOw�J m�lh5�Ov`" =�IW�iOJە� ;h�QFR2xQ14o˺�L2ES[#=�7rS�-`B�#^UsS�(��w �%:�8TvrILoyt0)(�ʰ�7V�5wHT��:aߴ~J� D� 5Ϭ%�ij,{q�>P5ݼ@:6v�2� 0KR^Z3�/u!Z|�'[�#�z $'m6r�p<~*Rui� �$tM�Az!tz�_{ߐ�w#bhNZq7;Yw9\~�M�6ȋ0Z�v`0[�0I�4� ["�%_}sx�;}A W�7,8�H>{9�<@:Co_gŒ�픲K�#1�P�6Wz|�__f>�?�r�:[�S� )�Oa,iH鉶6�(z SHi^w r�*UQko�!�>uYmz2RU쟐Q3�� T0B� ?�fx�yS � �,j�Q(Z$}7'�(Ld]Uw�8ixf�m4H�$Y9HYH�;Pj}:%2fDZ�-H_$K[�nq�m T� \ ~kC5v �%^7da'`Yc`/`M�1`S�Lmd2 PyO45dKuV�FQrCHJK  �;L FpA&Q&zJ%|F�r\M6�:A��7͗�*�N2}_�?JCr�=�ӡY�- -_M$[bQg5L��. �9CKPꑶʶz�)�".AU�/Etå}�, {Kr ̋Hh)\�ܧo?YR 6æ)P=�6 YVjTw�%JBe�wlTyU v0E���5=rHB|� qm�z {<�j|SQqM�?TZK�:� UPW�.K� X�"yfju��=�3� 8ːr⢭3!M�߉>8@Lƒ c�?e;_T�Cn IDAT�+ u NJq�. >HYUqxI�0\#I�!)RUe�026�s@ޫCrRYI;�W^ SR�5Tk�&� �gCvW@_]%>Y$gi`� �3�&_},GI@ dWCT�7m�)r/M@JwʞQlZ|Z*9o�M1Fʌu1Udg�ITa��5`i9NBԌ@:3dK%eFmTMȍV� QBc|_|�%PX�Rz (EkNε�'η2Ln"^s G�Hjo�:T8+�:$' !Xh�9c�2`]JWA=G `k� ~~fn p'@�6�>=Zޡ�._� �2nS�4�L̴E�?�6uT: |Q0x S39YBT ;Z�L�CL-lM'=q`2)WYl�XK#W�>d�F~J ,0LJ?N�3BI%.FbƮ� �]I�:2U)l&��3`uo�o\�3��8:�4_�o%� @*oہzHta x�]~t}<]8SV&~ژLJ���s1x{QN^*J'�2Ep:�2ZDd�2np�/$N^ZC^=U- Ju`��>dMلVˢs�bwK_8*(kȺkU uK|Z{ߑnG�qlL^�$E3H�y24EDbܛ'W:�#*hEgʬC΀ԃYvkI3I�op?zh7⣑|�=?K 6#nN۶l%}�X:% ڽ�E ]Jh|cV�zOouW I=�"�SIw*uSom-j*Ҍr&h]J>v]l~!O�;> �4�]T&U:(V:چ|Ҁ�P2>`\jx�69H~�5�).b)�PN@jP� uc�7N�8w7hW�weܤr�$�� BZ!�2@�0o@�9[%1�a� :�+Cq�hpwgXH~N.aJ�oxhwp��0�:ZM�,L, : 5�7AG'ϐ"QPEp[9 E�#eMu*\2�=rZu;� �~�,_ '?�@A� ʯv(.U�4~^ju V"_Lm�G{u� q\N�rCMesd'*R6Q� �Š)j.�,ڡ2׉E� xӋP\q�*v#ke6`UP�eTJ�#&Y�>~R -��bD@�00XU_w2��*��3��"Xq./K�_R�P�&�( W8>Of6�ZOw�/XB�;M~5rM�$g±� {T.h��@nCZ�J zJƛB\�>βb` pڌZ�<�h\u�{2K̻�k�2q2 � N<�>N>XT=Qd`t�>�$Ac'�=�ض�{�Yt(�.#�vp~^j�� Nz"Q �5!�wr^�*�_L׃uRǶzYx� Bcsh�<$ftJԌ�4�;C6ï�x48mBD@n'U{k4N&�2H HSJӿ8#�,�*�x^IzKJf[EK~�6q�bT-ފk� ‰E_�,LTqgkq�35K7aAGɯ>\dßٴ{w�`Q/GXS1[2HT�:ҰV�(�� L~�)Gpns�5C�U�H�+Y �_�;qfث!`�0A�(l��!�'+G n?� �fG(G<|*C@�'M�љ{T]y R9$i�z٬I[fFt2� 䪅��)�=?|7JYOt��%e�?!k�[\�)?D|�#KHcqNbu9 n+uIuG4KlM/�&%B@J�8go%�(7 ?P#S^o/c{��3|SIn+CIW�#Y5o�;|^N]�*G� sF=|,ҴvuOIHV8�8:Y�M6Bb��B}a���;6Ej?4�(`�*t`AUРvf|�[뇍HdBlC�q��:ӣ$� S NJϩ�2hg�?7iy}Ƴ�-x*Y)wm ?�~v�X3S[[�A BD�#�.&ݥkz<�+~sdɎF0FUL؈.� ppWn^NҸ�->P{=�JP�z{խYM򊔃d"-kx�qbL�5 (@`�*KNM7d5YVlḽ>Jx_`@C 0}��8#�?A� �+gh4OPSTAA�1/&�:WJ7�&Y˱`'_ �_� E6Sjp@KoD&ei�;PY}'8�<2]:�M|��*fp>5E{¼1k�Ǹy<�;x>��>0~15%Ė}7^��Ta�=5p�Ѱ¹7�??l1֧5ؘٿg����$gcQDp_�u7K(H|8 ~\p8�;�7ˑ0d֛Mn#zHO`eM�Y�/� ��IUFis�\U��(tQ^mZ#)�/khV�'}N'i9{ ۧ.c\�h^3ռ%+? #;6-3dN�'P�$�!u!B�ݞd;~w��-~�ls� A#~j8�)Y5vvq�TT� BL�*[HT !ʐ$�/k 'e�?�E}FDA;i|YzdߝlS&x_ s7R%}[�r�V*ѰݸkwXط�6iMN3�-ŗ� �/�9LqF*n>"?ݳ#<'e^�od�B_BiP��xH\�9��.9IBaВyhh鬹`"Пud� Tnh�9v%hP"!p L%jipX�'pCy-� �g8VY^w=tuZ~0e58Q0DN^4KotQT�'�/`]a�2}�>ˊ˾dASTFIx�>tu �.|ӜX=;߲:99�*i� ϭxy[)[QHzr�0�>`EG!9YpN#�gxXRjd+�ar�9ҫ�5IMh,S� �dzA]|n�:�Bb" e�4�3el� 8"\&�&ݥ?xXfp11�,M"Q=1@0dƁll�>�S�*ƺܱ<BXٚ�_AE}�h�1B�}4�? @�� Kӡ]CPZzu��gټԏU�<*iEbCb53Sn>NP k%�dyy)Aʅ,��,Ze~B?,�r�+6� _ij�%Ŝ׉!W��@�Bqw�')�IE.�5z�R�|`e�% 'HFk� Ye�$n1IA�kV1�%DͱI�bT#�hn0wʝvo){wK矁mT�m|� >�<> Ѯ)e�Edx�>W'�js /o8IU\ky\xvrYڲp!^e~s\�>�3|h��7w�mܟpTl�7^ \-O$[�8;�,t�r�5�%M�*S˜?�:E{cR#wǍPJz��9-ţf��Bs,lj!}{bL�:1c'RV2x]�� Q9� L�8 ĘZMLM�$�L*K`nd7YeU)Y}=F� %7�-H_-wVQlgkɛ%x7��!�n�)@#�Q�_FmuRN�% Ut3߉3y�(`PgDf�rHB] �!!�&8^~� pW%�2P�8A�:܏ xTE�N�qy�H� �(�0�:��:ā~u w�mWVݳA�SRx!iz;m�\a*�8vZvCf yYE՞�.{g��?�-i6zXyØ\7؍OBhei�6M��2r08yh; k'{Iw8Jm4 4dyZr|VP8LAţ�3,tjA_�4 f}]-,SJ)�, _�.c RajAvX ˦�T-�:\߶|Ы� �kfFJU8tA_.ޮa6\Jkz�2\l\�JmHس}8o�9�2�2 "R�fISG�4{�S�\�2&��3y2kdqZWܡ%HVN:B_HJy�l)NJ��%aFBEeߢ�Ri+ĬG�F�'*�>R0PrMN+[V�(�i_�&.6IX[Sn]o�ڔ6ڛ5fzF[|C�زb�6LIV�;qp)C2?Q q{:���2�zJӺ6Bk r�爄\>�ڔ1oW>��1J_A�8O:cu\~W;s@M|:6W$2)LHvxS�jJ~󅲦{rfWbu([Q�1,Wd]nVA Ѹ�2mLA�́y,/ۼC�ʛU��);Zc�7rWhQ3}VRTO�/ej`֍@PEB�#0 oܞz~ d:0�n~ce1�.1T� �J0l�"�"EiOZYN"�v56a%�2d�QN � =VtZBO*�,�;�33g3q\�ηZ]Pz�"R Nϗ4W h(S}�(\����������������������������������������������������������������������������������������������������������������������������������ɧswt�9> p(1nbMBg\�DU%,st_{\p;U5�&�$2C>Xt6q�ܕP*.Ji�yW>d�X�7C�:�#x�9� s;Sz<�-M BN~yy�:_T[-#V�zBDnʛX_4FmH6D>Jf.�;f�0 ˍFz:ߤgYi�9ԞHV_XD̑꬙]4yΛiYU@jO�#x�$PӳlGϐ�$f}Խf%�?(cLB۞�ȓc5!`~SbH�?jryUU16O29p?�$7J=>t$s᭒�>zٖː�x٬�>&}�Ϸ[F,zΌiVJ>],�a_ӉK:Dמ�#�Ĥ}~S g&ӋlQS+,Zf;jF�+ FL� a}}⇥zy1E3Iq�9/oQ䘟H�'1S7%uHZoƢϒE-!F1�2*�7U8u�@�/�\X)�ή3]cBYR�;y 2TTog,T4�ר�[ǭ[b\V?� /N~E:ݘɗ6Ϻ�?aav`�� Hs� X �'�c� 4�64|X$�ё&S�6sR蓉o]ÓUxJ��J�4&kzLߖD�*CVS|KۇT�laJ0p�fA�36cf =Jqd_OSg�3 >4ȗa@*n v׿M;v\�4�.Y?){S>�a6~�I�x�H� 8ӈmmfpoi3ԛ�,�dPF.�M7| x)}?o׸kn'^�=v�4Da�"6Qu�09XLZ �FZR���3U'YyכCfJr�a!_t�G� �=||5+��mkrw�-RH})Lŏ;b3k6R~ѱ I&ARSޭ�;Pք@RG� ~uo{"jCڒ^�7�,ڸ۬"tdH$S�g�gEDG�65oSw��;ogxZ��QV93� |Z~tweBA�=�0~ q0vu^6QqL¤4D˵[kz_(,Qӳ�=�2OuE'�*�$�[AR�;w:hw�:X0M68D+wL l W܁͵^=Iý?MiM]b�+:G"�8� �JbXڞLVUw{w��uVQGT'rśwt��<�>E�)[� �?GST�0\oTu0sa)�?R�-Ǭa=īE�%2L�&m�6\#Ysl35w~S|HZr u�&��ƾ�)Z~ZLM�fhi�ۀq؊� zHnԇT́Bs{@�qn�[Z˼`$;pSV�-:u{�g p�+��q`+�>\]o�Z_}|;lP;uy�)� )rKLlzB^��Lv:R:�(i�1NGjSwl� Z6i@]1NrX0֯*>�,E*H%�,<&R�/ .򩛅Mp�+YV|5ެI\�#�#z<�2e*5B �/s/bfV�*]O�|�)3�!s@[�x �"w.�ђBWE0)c !S/T�=ze�$᣹f0Z!&gͶ!͂T/i{�-wɘV� U"��7 ~StO54d C7}#�#-H[�<$KB|ROۦkD�/� g(9l� O��$¨�V%Zc_P Yyy&~cA.%k~ӕU UD}W�?sAH� èlI?NDH>B'vDFYW KkH) UIwn#*iW�/�>9�!U�'�/\ʰ|�8�P�)e�;>Ypʏ@3@_E�T]6)h�#&8؇0�('F#�T:Q_�8A#~UJA~a�ifu8C� ~[KÍhj�*k�'�8W!|XBlFf$2cꂆ*{�Cjbi/İʁUL@fG6P�;eU#P�-n&)Gi@,Iv)I?�6#'dǤ:�4��UU~SAv �)GHGy-4�-|�.�3�@U0Elv|gLj_5+ddF݅ � +oq=@k#!%B�[Z�1yIgrŔu�hl�:ѻͤ�(�&j�0pK[Y.5&[|Crf_P0�8m%/Q;�?|cNk[Ӗ]/DXY�"Y(cP(E|�&SKd� o]R� 6�4S]ܧl1sU[8.mx^z:'�}�N t󙀼�XLg�-|�:όMp`vC�HlQv>!�7�<�0L1=u $�R%�GxA\s�2C�6sS&kc�)8c bWOz Mti� 9 �(*O�5 �@TnOeEWxƔ%YP �#q� ƣF�3fHz�-�vu_�CZc6ij?Ԫ�;S�5w^�!Y�9S�/�6UnФa;kh5Xl,+{�;X`N6v�]Ù J�?Hx~�6=*N>#g�5�:�YWCl�+׌@�0ݤl4`"�/�>txWa�3c{ 4խ9G�/I�=�-0P[ꅭY�OmfJ��!QKL(ؖmc\0ERM"?;XٓckS�)?v/%Kw)JpL4tT+{�?xʘG�)c�|seհ�07!GB�V�-Z�6U9$ "�4˱v4˄GD _(]H.3i) (| @Q%QgK_@C)y(2 !�>�$ٶ�<� !j ;#歱;W|y4Gk�rH >kO*OBs3c�GE�+*1rz߷ [no� ?h|O8h(?Q}ɼ=�k�%_N�XK}K @i�:z԰i^� �BS�1g}TBR$( njcQ`<.e>֥`b�$&Cה5f|�)-b�5Z3l|� [$D�2�=a8O�= ug" NjVޠtsM�'�,�85⊊e tɼ~@J0�v07dx@mwbYV�&)f� Y�7(B CJ΄/<�i)@yk�h>�u\ꩽ�J}p QvRl{kwh2�"P M%�!\bx2@z� � `xH"5Z|<�Σnm�j VY`':���1�%P,߰\BϔJ}tW�-_�)3mznUbfr�&J�bj�5ݔc~'9arx/�6 Q�8[udU96� K:/ITH?c۾́Yl�&Wv}��.,ujj@R.W5"급L`Slb^c�/OD`R��(ՑUk-[$oyg}t-G�3N�"g� � �11r[JRLD|QG~EKa�iqf �N蔶N~DiҲMstpI~uuWg+T`�_��16Xג" @vdtyp ,9kAȥipߣ#ְݕմө<ң=bbwV�&r_;I2JCy�*YՃ�Ƅ�,r.�.&`VRuQ�3BBЊ�-^�9ζXr.畕x"x$ψߙR� @n~};�/�.,-N$9yڛO�ʘ9آe�?2�;;\ݯo}�4G1�{;�*QyxDHr;2* 'ͥ X_qDT"suC2ezSG}\IUBG#�IQ9�A *U�MI:Ʒ])@rr"8?]bSOf�4 c�:m�?lױ ��픱�>DҜ?�7uf�=)ҥϣ;�(UWKS� yKzJ�d� �/i6�3OdfZe{R�-YS-� �$߻sC\6��Zrjr6�1_AC�>�'*�4�ѥ߶mNxS[�5!~U m{ti)aڷI)� vFyٔ{6R(�)?~ܵ}\m�>m�z}�)=t^}_-̧pD'nRUh�}d܇.·��!�:"=>j\HY��'{!b6ᇂ`T�6)3�tlGd�4s/ϔɗՄʼ@3xc՛|ʷ/B�#�Bk�#ys�Uev� JwXM��-&#vp|He�`N\"D9If7�,_G4IOrub ~mES^k׮١U;J�t �����*�4i�0oE@r�8KQoPf*]"ʳ-O贵T,KG̽u)4G=c!ȕ9 /%x8� ޻_I=�☓4Edy4S�G�)pxYi] to verify audit file privileges. 01. Login is successful. 2. The following information is shown: " List of audit journals, including the journal owner " Security auditing server characteristics " Security archiving information " System security alarms currently enabled " System security audit currently enabled Warning thresholds are established. (e.g., AUDIT /JOURNAL=SECURITY /THRESHOLD=WARNING=100) 3. The audit server runs with a maximum size of page files (20,480 pages). 4. AUDIT/SERVER=FINAL_ACTION=IGNORE_NEW 5. Audit file privileges are set to READ ONLY by Security Administrators. VMS-21SI-4]An anti-virus software is installed on the system. obs and diskettes are scanned regularly.�1. Verify that an anti-virus program is installed and running. 2. Verify that system files and media are scanned regularly before use. �1. Norton Antivirus is installed and running. New signature files are pushed down and installed every Thursday or when a new file is required. 2. Directory files are scanned regularly. All media is scanned for viruses before use. VMS-22<Update for NIST 800-53 Rev 3 Update for new Publication 10751Increase version to 1.0. Update to new template.�% NIST Control Name&Full name which describes the NIST ID.hMinor update to correct worksheet locking capabilities. Added back NIST control name to Test Cases Tab.NIST Control Name8Identification and Authentication (Organizational Users)(Device Identification and AuthenticationAccount ManagementLeast PrivilegeSeparation of DutiesSystem Use NotificationFlaw Remediation Session Lock Time StampsInformation System Monitoring)Update test cases based on NIST 800-53 R4Unsuccessful Logon AttemptsContingency Plan Testing Audit Events1. Minimum password length is 8 characters, minimum of 1 numeric or special character, mixture of at least one upper and 1 lowercase letter 2. Password parameters are displayed as follows: " PWD_LIFETIME: 60 days privileged users and 90 days for standard users " PWDMINIMUM=1 days " PWDWARNTIME=7-14 days " INITIAL PWDCHANGE=1 day 3. Users cannot use their 24 old passwords. 4. The LGI_HID_TIM maintains a history list of users old passwords. 5. The password is rejected. 6. The password is rejected. 7. The password is accepted. }Passwords consist of a minimum of eight (8) characters. Passwords have at least one number or one special character, one upper case and one lower case letter. Initial passwords are changed immediately. Passwords are changed at least every 60 days for privileged users and 90 days for standard users. Passwords are not reusable by the same individual for a period of 24generations.HPlease submit SCSEM feedback and suggestions to SafeguardReports@IRS.govHObtain SCSEM updates online at http://www.irs.gov/uac/Safeguards-ProgramPUpdates based on Publication 1075. See SCSEM notes column for specific updates. Agency Code: Closing Date:Shared Agencies:sAdded baseline Criticality Score and Issue Codes, weighted test cases based on criticality, and updated Results Tab �% Criticality.A baseline risk category has been pre-populated next to each control to assist agencies in establishing priorities for corrective action. The reviewer has the discretion to change the prioritization to accurately reflect the risk and the overall security posture based on environment specific testing.All SCSEM Test Results JFinal Test Results (This table calculates all tests in the Test Cases tab) Overall SCSEM StatisticsPassedFailed Additional Information RequestedTotal Number of Tests PerformedWeighted Pass RateTotalsWeighted Score Risk RatingWeightPossibleActualDevice Weighted Score: CriticalityCritical SignificantModerateLimitedCriticality Ratings,Sections below are automatically calculated.HPW7HAC15HAC27HPW11HAC11HAC12HAC14HRM5HSI2HSC1`If passwords are not required to access the system, the criticality may be upgraded to Critical HAC10HRM7%Remote access is properly configured.HCP100Network Loca< tion:Device Function: InternalExternal Stand-alone �% Issue Codes�A single issue code must be selected for each test case to calculate the weighted risk score. The tester must perform this activity when executing each test. Issue CodeRisk Rating (Do Not Edit)HAC1+Contractors with unauthorized access to FTIHAC2GUser sessions do not lock after the Publication 1075 required timeframeHAC3AAgency processes FTI at a contractor-run consolidated data centerHAC41FTI is not labeled and is commingled with non-FTIHAC59FTI is commingled with non-FTI data in the data warehouseHAC6&Cannot determine who has access to FTIHAC7.Account management procedures are not in placeHAC8<Accounts are not reviewed periodically for proper privilegesHAC9/Accounts have not been created using user roles=Accounts do not expire after the correct period of inactivityHAC100Other?User access was not established with concept of least privilege$Separation of duties is not in placeHAC13?Operating system configuration files have incorrect permissionsWarning banner is insufficient@User accounts not locked out after 3 unsuccessful login attemptsHAC16HAC174Account lockouts do not require administrator actionHAC18#Network device has modems installedHAC197Out of Band Management is not utilized in all instancesHAC20Agency duplicates usernamesHAC214Agency shares administrative account inappropriatelyHAC22FAdministrators do not use su or sudo command to access root privilegesHAC23)Unauthorized disclosure to other agenciesHAC24=User roles do not exist within the data warehouse environmentHAC251Agency employees with inappropriate access to FTIHAC26/Inappropriate access to FTI from mobile devices2Default accounts have not been disabled or renamedHAC28/Database trace files are not properly protectedHAC29HAccess to system functionality without identification and authenticationHAC30-RACF access controls not properly implementedHAC31FThe database public users has improper access to data and/or resourcesHAC32EMainframe access control function does not control access to FTI dataHAC33"FTI is accessible to third partiesHAC34#Improper access to DBMS by non-DBAsHAC35"Inappropriate public access to FTIHAC368Agency allows FTI access from unsecured wireless networkHAC371Account management procedures are not implementedHAC38Warning banner does not existHAC393Access to wireless network exceeds acceptable range:The system does not effectively utilize whitelists or ACLsHAC41>Accounts are not removed or suspended when no longer necessaryHAC422System configuration files are not stored securelyHAC436Management sessions are not properly restricted by ACLHAC44-System does not have a manual log off featureHAC45Split tunneling is enabledHAC46BAccess to mainframe product libraries is not adequately controlledHAC47Iobs containing authentication information are not adequately protected HAC48BUsernames are not archived and may be re-issued to different usersHAC49HAC50/Print spoolers do not adequately restrict jobs HAT1/Agency does not train employees with FTI accessHAT100HAT21Agency does not train contractors with FTI accessHAT3)Agency does not maintain training recordsHAT42Agency does not provide security-specific trainingHIA1AAdequate device identification and authentication is not employedHIA2.Standardized naming convention is not enforcedHIA3=Authentication server is not used for end user authenticationHIA4;Authentication server is not used for device administrationHIA57System does not properly control authentication processHAU1,No auditing is being performed at the agencyHAU2,No auditing is being performed on the systemHAU3!Audit logs are not being reviewedHAU44System does not audit failed attempts to gain accessHAU5;Auditing is not performed on all data tables containing FTIHAU68System does not audit changes to access control settingsHAU7+Audit records are not retained per Pub 1075HAU83Logs are not maintained on a centralized log serverHAU9No log reduction system existsHAU10%Audit logs are not properly protectedHAU100HAU11NTP is not properly implementedHAU12HAU131Audit records are not archived during VM rollbackHAU14Remote access is not loggedHAU15;Verbose logging is not being performed on perimeter devicesHAU16FA centralized automated audit log analysis solution is not implementedHAU175Audit logs do not capture sufficient auditable eventsHAU18:Audit logs are reviewed, but not per Pub 1075 requirementsHAU19<Audit log anomalies or findings are not reported and trackedHAU20=Audit log data not sent from a consistently identified sourceHAU212System does not audit all attempts to gain access HAU22*Content of audit records is not sufficientHAU235Audit storage capacity threshold has not been definedHAU24GAdministrators are not notified when audit storage threshold is reachedHAU25DAudit processing failures are not properly reported and responded toHCA1?Systems are not formally certified by management to process FTIHCA100HCA2*Undocumented system interconnections existHCA3@Agency does not conduct routine assessments of security controlsHCA43No third party verification of security assessmentsHCA5>POA&Ms are not used to track and mitigate potential weaknessesHCA6HCA77SSR is not current with Pub 1075 reporting requirementsHCA8 Rules of behavior does not existHCA9#Rules of behavior is not sufficientHCA10BAssessment results are not shared with designated agency officialsHCA116Interconnection Security Agreements are not sufficientHCA123POA&Ms are not reviewed in accordance with Pub 1075HCA13BSystem authorizations are not updated in accordance with Pub 1075 HCA148A continuous monitoring program has not been establishedHCA154The continuous monitoring program is not sufficient HCM1+Information system baseline is insufficientHCM2%FTI is not properly labeled on-screenHCM3-Operating system does not have vendor supportHCM4ZRoutine operational changes are not reviewed for security impacts before being implementedHCM59Web portal with FTI does not have three-tier architectureHCM6VAgency does not control routine operational changes to systems via an approval processHCM70Configuration management procedures do not existHCM83The ability to make changes is not properly limitedHCM9=Systems are not deployed using the concept of least privilegeHCM10+System has unneeded functionality installedHCM11!SNMP is not implemented correctlyHCM125Offline system configurations are not kept up-to-dateHCM13)System component inventories do not existHCM14)System component inventories are outdatedHCM15*Hardware asset inventory is not sufficientHCM16*Software asset inventory is not sufficientHCM17'Hardware asset inventory does not existHCM18'Software asset inventory does not existHCM19HCM20FApplication interfaces are not separated from management functionalityHCM218Permitted services have not been documented and approvedHCM22;Application code is not adequately separated from data setsHCM231System is not monitored for changes from baselineHCM24&Agency network diagram is not completeHCM25,Zoning has not been configured appropriatelyHCM26,Static IP addresses are not used when neededHCM27+Information system baseline does not exist HCM28<Boundary devices are not scanned for open ports and servicesHCM29HCM306System reset function leaves device in unsecure state HCM31!Default SSID has not been changedHCM32>The device is inappropriately used to serve multiple functionsHCM33RSignificant changes are not reviewed for security impacts before being implementedHCM34NAgency does not control significant changes to systems via an app< roval processHCM35=Services are not configured to use the default/standard portsHCM36,The required benchmark has not been applied HCM37<Configuration settings and benchmarks have not been defined HCM100HCP1'No contingency plan exists for FTI dataHCP2)Contingency plans are not tested annuallyHCP3<Contingency plan does not exist for consolidated data centerHCP4.FTI is not encrypted in transit to the DR siteHCP5HCP6(Contingency plan is not updated annuallyHCP7"Contingency plan is not sufficientHCP8%Contingency training is not conductedHCP9'Contingency training is not sufficient HCP10'Backup data is not adequately protectedHIR1(Incident response program does not existHIR100HIR2(Incident response plan is not sufficientHIR3HMA1>External maintenance providers not escorted in the data centerHMA100HMA2*Maintenance not restricted to local accessHMA3/Maintenance tools are not approved / controlledHMT15Risk Assessment controls are not implemented properlyHMT2.Planning controls are not implemented properlyHMT38Program management controls are not implemented properlyHMT48System acquisition controls are not implemented properlyHMT5*SA&A controls are not implemented properlyHMT6:Contingency planning controls are not implemented properlyHMT7>Configuration management controls are not implemented properlyHMT81Maintenance controls are not implemented properlyHMT9FSystem and information integrity controls are not implemented properlyHMT107Incident response controls are not implemented properlyHMT100HMT11<Awareness and training controls are not implemented properlyHMT12GIdentification and authentication controls are not implemented properlyHMT13,Access controls are not implemented properlyHMT145Audit and accountability are not implemented properlyHMT15JSystem and communications protection controls are not implemented properlyHMT16Documentation does not existHMT17(Documentation is sufficient but outdatedHMT18*Documentation exists but is not sufficientHPW1/No password is required to access an FTI systemHPW2Password does not expire timelyHPW3$Minimum password length is too shortHPW4#Minimum password age does not existHPW55Passwords are generated and distributed automaticallyHPW6 Password history is insufficient.Password change notification is not sufficientHPW8.Passwords are displayed on screen when enteredHPW90Password management processes are not documentedHPW10"Passwords are allowed to be storedHPW1006Password transmission does not use strong cryptographyHPW12-Passwords do not meet complexity requirementsHPW136Enabled secret passwords are not implemented correctlyHPW141Authenticator feedback is labeled inappropriatelyHPW15$Passwords are shared inappropriatelyHPW163Swipe-based passwords are allowed on mobile devicesHPW17'Default passwords have not been changedHPW189No password is required to remotely access an FTI system HPW19>More than one Publication 1075 password requirement is not metHPW206User is not required to change password upon first useHPW21>Passwords are allowed to be stored unencrypted in config filesHPW22LAdministrators cannot override minimum password age for users, when requiredHPW23$Passwords cannot be changed by usersHRA1"Risk assessments are not performedHRA100HRA2+Vulnerability assessments are not performedHRA3AVulnerability assessments do not generate corrective action plansHRA4ZVulnerability assessments are not performed as frequently as required per Publication 1075HRA55Vulnerabilities are not remediated in a timely mannerHRA61Scope of vulnerability scanning is not sufficientHRA7MRisk assessments are performed but not in accordance with Pub 1075 parametersHRA8:Penetration test results are not included in agency POA&MsHRM1HRM100HRM2HRM3 FTI access from personal devicesHRM4FTI access from offshoreNUser sessions do not terminate after the Publication 1075 period of inactivityHRM6>The mainframe is directly routable to the internet via Port 23CThe agency does not adequately control remote access to its systemsHRM8+Direct root access is enabled on the systemHRM9-VPN technology does not perform host checking;Client side cache cleaning utility has not been implementedHRM11?Site to site connection does not terminate outside the firewallHRM12HRM132The agency does not blacklist known malicious IPs HRM14<The agency does not update blacklists of known malicious IPsHRM15HMulti-factor authentication is not enforced for local device management HRM16'VPN access points have not been limitedHRM176SSH is not implemented correctly for device managementHSA1;Live FTI data is used in test environments without approvalHSA100HSA2;Usage restrictions to open source software are not in placeHSA37No agreement exists with 3rd party provider to host FTIHSA4CSoftware installation rights are not limited to the technical staffHSA5FConfiguration changes are not controlled during all phases of the SDLCHSA6ISecurity test and evaluations are not performed during system developmentHSA7?The external facing system is no longer supported by the vendorHSA8[The internally hosted operating system's major release is no longer supported by the vendorHSA9[The internally hosted operating system's minor release is no longer supported by the vendorHSA10SThe internally hosted software's major release is no longer supported by the vendorHSA11SThe internally hosted software's minor release is no longer supported by the vendorHSA12AInternal networking devices are no longer supported by the vendorHSA13NIT security is not part of capital planning and the investment control process'FTI systems are not included in a SDLC HSA156FTI contracts do not contain all security requirementsHSA16'Documentation is not properly protectedHSA17;Security is not a consideration in system design or upgradeFTI is not encrypted in transitHSC2$FTI is emailed outside of the agencyHSC3,FTI is emailed incorrectly inside the agencyHSC4%VOIP system not implemented correctlyHSC5No DMZ exists for the networkHSC60Not all connections to FTI systems are monitoredHSC70NAT is not implemented for internal IP addressesHSC8Network architecture is flatHSC9,Database listener is not properly configuredHSC10'FTI is not properly deleted / destroyedHSC100HSC11GNo backup plan exists to remove failed data loads in the data warehouseHSC129Original FTI extracts are not protected after ETL processHSC13+FTI is transmitted incorrectly using an MFDHSC14(VM to VM communication exists using VMCIHSC15;Encryption capabilities do not meet FIPS 140-2 requirementsHSC161System does not meet common criteria requirementsHSC178Denial of Service protection settings are not configuredHSC183System communication authenticity is not guaranteedHSC19HSC20HSC216Number of logon sessions are not managed appropriatelyHSC22'VPN termination point is not sufficientHSC23"Site survey has not been performedHSC24HSC25ANetwork sessions do not timeout per Publication 1075 requirementsHSC26HSC27$Traffic inspection is not sufficientHSC28%The network is not properly segmentedHSC291Cryptographic key pairs are not properly managed HSI1>System configured to load or run removable media automatically"System patch level is insufficientHSI3#System is not monitored for threatsHSI4$No intrusion detection system existsHSI57OS files are not hashed to detect inappropriate changesHSI64Intrusion detection system not implemented correctlyHSI7;FTI can move via covert channels (e.g., VM isolation tools)HSI89All VM moves are being tracked in the virtual environmentHSI97Network device configuration files are not kept offlineHSI10EHash sums of I< SO images are not maintained in the virtual environmentHSI100HSI11AAntivirus is not configured to automatically scan removable mediaHSI12(No antivirus is configured on the systemHSI137Antivirus does not exist on an internet-facing endpointHSI14HSI165Agency network not properly protected from spam emailHSI17)Antivirus is not configured appropriatelyHSI189VM rollbacks are conducted while connected to the networkHSI19#Data inputs are not being validatedHSI20HSI21EFTI is inappropriately moved and shared with non-FTI virtual machinesHSI22&Data remanence is not properly handledHSI235Agency has not defined an authorized list of softwareHSI24@Agency does not monitor for unauthorized software on the networkHSI25=Agency does not monitor for unauthorized hosts on the networkHSI264No host intrusion detection/prevention system existsHSI270Critical security patches have not been applied HTW1,Tumbleweed client is not configured properlyHTW100HTW26Tumbleweed certificate is assigned to the wrong personHTW3*No written procedures for using TumbleweedHTW4<FTI is left on the device running the Tumbleweed applicationHTW5HTW6HMP1$Media sanitization is not sufficientHPE1:Printer does not lock and prevent access to the hard driveHPM1,A senior information officer does not exist This SCSEM is used by the IRS Office of Safeguards to evaluate compliance with IRS Publication 1075 for agencies that have implemented OpenVMS for systems that receive, store or process or transmit Federal Tax Information (FTI). Agencies should use this SCSEM to prepare for an upcoming Safeguards review. It is also an effective tool for agency use as part of internal periodic security assessments or internal inspections to ensure continued compliance in the years when a Safeguards review is not scheduled. The agency can also use the SCSEM to identify the types of policies and procedures required to ensure continued compliance with IRS Publication 1075. This SCSEM was created for the IRS Office of Safeguards based on the following resources. �% IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (October 2014) �% NIST SP 800-53 Rev. 4, Recommended Security Controls for Federal Information Systems and Organizations (April 2013) �% DISA Open VMS Security Checklist, Version 2, Release 2.3HAC29 HPW8 HAC20�HAC29: Access to system functionality without identification and authentication HPW8: Passwords are displayed on screen when entered HAC20: Agency duplicates usernames4HPW7: Password change notification is not sufficientGHAC15: User accounts not locked out after 3 unsuccessful login attemptsBHSC15: Encryption capabilities do not meet FIPS 140-2 requirementsFHAC11: User access was not established with concept of least privilege�1. User accounts that have not been used for 120 days are disabled. Disabled accounts are removed after a specific interval of time.Z1. Verify with the system administrator the process for disabling accounts after 120 days.DHAC10: Accounts do not expire after the correct period of inactivityTHRM5: User sessions do not terminate after the Publication 1075 period of inactivityFHAC13: Operating system configuration files have incorrect permissions HSI2 HSI27`HSI2: System patch level is insufficient HSI27: Critical security patches have not been applied IHRM7: The agency does not adequately control remote access to its systems-HSI22: Data remanence is not properly handledHSI12 HSI11 HSI17SA-22Unsupported System ComponentsInterview, ExamineHSA7 HSA8 HSA9 HSA7: The external facing system is no longer supported by the vendor HSA8: The internally hosted operating system's major release is no longer supported by the vendor HSA9: The internally hosted operating system's minor release is no longer supported by the vendoreCurrent version of the operating system installed and the agency maintains appropriate service packs.VThe agency maintaining the operating system ensures the operating system is supported.HAC51Unauthorized access to FTI HAC52*Wireless usage policies are not sufficientHAC53HAC544FTI is not properly labeled in the cloud environmentHAC555FTI is not properly isolated in the cloud environmentHAC56MMobile device does not wipe after the required threshold of passcode failuresHAU26cSystem/service provider is not held accountable to protect and share audit records with the agency HAU27<Audit trail does not include access to FTI in pre-productionWApplication architecture does not properly separate user interface from data repositoryHCM38;Agency does not adequately govern or control software usageHCM393RACF security settings are not properly configured HCM401ACF security settings are not properly configuredHCM418Top Secret security settings are not properly configuredHCM424UNISYS security settings are not properly configuredHCM432IBMi security settings are not properly configuredHCM44=Agency does not properly test changes prior to implementationHCM457System configuration provides additional attack surfaceHCM46HCM47>System error messages display system configuration information,Backup data is located on production systemsOAgency does not perform incident response exercises in accordance with Pub 1075HIR4dAgency does not provide support resource for assistance in handling and reporting security incidentsHIR5%Incident response plan does not existHMA4&Maintenance records are not sufficientHMA5HRA9BApplication source code is not assessed for static vulnerabilitiesHRM18)Remote access policies are not sufficientHRM19.Agency cannot remotely wipe lost mobile deviceHSA18%Cloud vendor is not FedRAMP certifiedEmail policy is not sufficientHSC30HSC319Collaborative computing devices are not deployed securelyHSC32:PKI certificates are not issued from an approved authorityHSC33HSC34FThe production and development environments are not properly separatedHSC353Procedures stored in the database are not encryptedHSC36;System is configured to accept unwanted network connectionsCAgency does not receive security alerts, advisories, or directives HSI288Security alerts are not disseminated to agency personnelHSI29%Data inputs are from external sourcesHSI30@System output is not secured in accordance with Publication 1075HSI31NAgency does not properly retire or remove unneeded source code from production�HSI12: No antivirus configured on the system HSI11: Antivirus is not configured to automatically scan removable media HSI17: Antivirus is not configured appropriatelyZRemoved duplicative test cases, re-assigned issue codes and revised weighted risk formulas)Mobile device policies are not sufficientHAC57BMobile devices policies governing access to FTI are not sufficient<Agency does not centrally manage mobile device configurationAC-12Session Termination4Issue Code Mapping (Select one to < enter in column L)HPW19 HPW2 HPW3 HPW4 HPW6 HPW12HPW19: More than one Publication 1075 password requirement is not met HPW2: Password does not expire timely HPW3: Minimum password length is too short HPW4: Minimum password age does not exist HPW6: Password history is insufficient HPW12: Passwords do not meet complexity requirementsHAC27 HAC37 HPW17�HAC27: Default accounts have not been disabled or renamed HAC37: Account management procedures are not implemented HPW17: Default passwords have not been changed HAC14 HAC38JHAC14: Warning banner is insufficient HAC38: Warning banner does not existHAU2 HAU6 HAU17 HAU21�HAU2: No auditing is being performed on the system HAU6: System does not audit changes to access control systems HAU17: Audit logs do not capture sufficient auditable events HAU21: System does not audit all attempts to gain accessHAU6 HAU17 HAU21�HAU6: System does not audit changes to access control systems HAU17: Audit logs do not capture sufficient auditable events HAU21: System does not audit all attempts to gain access HAU10 HAU23iHAU10: Audit logs are not properly protected HAU23: Audit storage capacity threshold has not been definedHAC58.Access control parameter thresholds are reset HAC59>The guest account has improper access to data and/or resourcesHAC60DAgency does not centrally manage access to third party environments HRM10HSC37CNetwork connection to third party system is not properly configuredHSI32@Virtual Switch (Vswitch) security parameters are set incorrectly+Axway does not run on a dedicated platform DFirewall rules are not reviewed or removed when no longer necessary LAn FTI system is directly routable to the internet via unencrypted protocols:Network perimeter devices do not properly restrict traffic=Digital Signatures or PKI certificates are expired or revoked<VLAN configurations do not utilize networking best practices+The data transfer agreement is not in place �% SCSEM Version: 2.1XTerminals are not left unattended. A timeout feature is set to 30 minutes of inactivity.�1. Login is successful. A warning message is displayed. 2. Contents of the intrusion database are displayed. 3. The timeout feature is set to TIMEOUT=30, which means the Server will log a user out after 30 minutes idle period of time. �User account is locked after three (3) invalid login attempts. Locked for 15 minutes or less then can be reactivated automatically.l1. Login is successful. 2. Contents of the intrusion database are displayed. 3. After 3 invalid login attempts, a user account is locked. 4. THE LGI_BRK_DISUSER parameter allows a user account to be locked. " LGI_PWD_TMO Define the time-out period " LGI_RETRY_LIM Define the number of times a person can try to log in " LGI_RETRY_TMO Define the time interval between login attempts " LGI_BRK_LIM Define the number of login chances " LGI_BRK_TMO Define monitoring period when a suspect becomes an intruder " LGI_BRK_DISUSER Enable the DISUSER flag in user's authorization record, permanently locking out that account DescriptionHAC619User rights and permissions are not adequately configuredHAC62RHost-based firewall is not configured according to industry standard best practice=The agency's SSR does not address the current FTI environmentHCM48>Low-risk operating system settings are not configured securelyEThe system's automatic update feature is not configured appropriatelyHSI33/Memory protection mechanisms are not sufficientHSI342A file integrity checking mechanism does not existHTC1&The Windows 2000 server is unsupportedHTC10+The ASA firewall is not configured securelyHTC100HTC11-The RACF Mainframe is not configured securelyHTC12-The ACF2 Mainframe is not configured securelyHTC133The Top Secret Mainframe is not configured securelyHTC14/The Unisys Mainframe is not configured securelyHTC15-The i5OS Mainframe is not configured securelyHTC16/The VPN concentrator is not configured securelyHTC174The Citrix Access Gateway is not configured securelyHTC185The Windows XP Workstation is not configured securelyHTC194The Windows 7 Workstation is not configured securelyHTC22The Windows 2003 Server is not configured securelyHTC204The Windows 8 Workstation is not configured securelyHTC21;Network protection capabilities are not configured securelyHTC22"The MFD is not configured securelyHTC231The GenTax application is not configured securelyHTC24-The data warehouse is not configured securelyHTC251The RSI data warehouse is not configured securelyHTC266The Teradata data warehouse is not configured securelyHTC27+The DB2 database is not configured securelyHTC281The Oracle 9g database is not configured securelyHTC292The Oracle 10g database is not configured securelyHTC3HTC302The Oracle 11g database is not configured securelyHTC31/The SQL Server 2000 installation is unsupportedHTC32;The SQL Server 2005 installation is not configured securelyHTC33;The SQL Server 2008 installation is not configured securelyHTC34;The SQL Server 2012 installation is not configured securelyHTC350The VMWare Hypervisor is not configured securelyHTC360The Tumbleweed client is not configured securelyHTC37/The internet browser is not configured securelyHTC38:The storage area network device is not configured securelyHTC394The voice-over IP network is not configured securelyHTC4HTC40/The wireless network is not configured securelyHTC415The custom web application is not configured securelyHTC42)The IVR system is not configured securelyHTC43)The web server is not configured securelyHTC44:The cloud computing environment is not configured securelyHTC45/The Apple iOS device is not configured securelyHTC464The Google Android device is not configured securelyHTC473The Blackberry OS device is not configured securelyHTC48:The Microsoft Windows RT device is not configured securelyHTC49,The mobile device is not configured securelyHTC5-The Solaris server is not configured securelyHTC50.Agency has not notified IRS of this technologyHTC51.Technology is not properly sanitized after useHTC52)The AIX server is not configured securelyHTC531The custom application is not configured securelyHTC540The SuSE Linux server is not configured securelyHTC55.The Adabas database is not configured securelyHTC56:The Windows 10 operating system is not configured securelyHTC572The Oracle 12c database is not configured securelyHTC58JThe Red Hat Enterprise Linux 6 operating system is not configured securelyHTC59JThe Red Hat Enterprise Linux 7 operating system is not configured securelyHTC63The Red Hat Linux server is not configured securelyHTC7,The CentOS server is not configured securelyHTC86The Cisco networking device is not configured securelyHTC91The Cisco pix firewall is not configured securelyWMoved Risk Rating to column AA, deleted lagging spaces from HAC40 and HSA14 in IC Table)Network device allows telnet connections HMT19JManagement Operational and Technical controls are not implemented properly&Publicly available systems contain FTI;The Windows 2008 Standard Server is not configured securely;The Windows 2012 Standard Server is not configured securelyHTC602The Windows 2016 Server is not configured securelyHTC615The Windows 2012 R2<o Server is not configured securelyHTC627The SQL Server 2014 database is not configured securelyHTC635The Windows 2008 R2 Server is not configured securelyHTC642The High Volume Printer is not configured securelyHTC654The system was not assessed during the onsite reviewHTC669The VMWare ESXi 5.5 Hypervisor is not configured securelyHTC679The VMWare ESXi 6.0 Hypervisor is not configured securelyHTC686The IBM z/OS version 1.13.x is not configured securelyHTC695The IBM z/OS version 2.1.x is not configured securelyHTC705The IBM z/OS version 2.2.x is not configured securelyHTC716The Checkpoint R76 firewall is not configured securelyHTC726The Checkpoint R77 firewall is not configured securelyHTC736The Checkpoint R80 firewall is not configured securelyHTC747The Oracle 11.2.0.4 database is not configured securelyHTC75.The Cisco IOS v12.x is not configured securelyHTC76.The Cisco IOS v15.x is not configured securelyHTC77+The AIX 6 server is not configured securelyHTC78+The AIX 7 ser      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~���ver is not configured securelyHTC79/The CentOS 6 server is not configured securely HTC80/The CentOS 7 server is not configured securely HTC81,The OEL 6 server is not configured securely HTC82+The OEL 7 server is not configured securelyHTC831The Solaris 10 server is not configured securely HTC841The Solaris 11 server is not configured securely HTC85.The SuSE 11 server is not configured securely HTC86.The SuSE 12 server is not configured securely HTC87<The VMWare Horizon 6 VDI solution is not configured securelyHTC88=The VMWare Horizon 7 VDI solution is not configured securely Updated issue code tablefSession terminations set to 30 minutes, account automated unlock set to 15 minutes, Issue code changesMinor content updatesInternal UpdateHAC63+Security profiles have not been establishedHSC38'SSL inspection has not been implementedHSC399The communications protocol is not NIST 800-52 compliant HSI35#Failover is not properly configuredHSI36'Malware analysis is not being performedbThe reviewer should verify what version of the operating system are running on the server by examining the server. The reviewer will need to have the Sr provide evidence that the vendor is still supporting the product. This can be done by visiting the vendor's web site, viewing a service agreement that the site has with the vendor, or observing recent patches provided by the vendor for the operating system. These are not the only ways that are acceptable to verify this, so the reviewer will have to make a determination if the site has provided sufficient evidence that the operating system is supported.�Vendor supplied passwords are deleted upon installation. A list of system users is maintained in the system's database. Guest account does not exist.LPrivileges are assigned with consideration to the user's role on the system. 03/031/2019HAC403Use of emergency userIDs is not properly controlled!Audit records are not timestamped1Non local maintenance is not implemented securelyHSA14&Datawarehouse has insecure connectionsHSI15)Alerts are not acknowledged and/or loggedHTC1015The Palo Alto 7.1 firewall is not configured securelyHTC1025The Palo Alto 8.0 firewall is not configured securelyHTC1035The Palo Alto 8.1 firewall is not configured securelyHTC104;The MacOS 10.12 operating system is not configured securelyHTC105;The MacOS 10.13 operating system is not configured securelyHTC106;The MacOS 10.14 operating system is not configured securelyHTC1072The Windows 2019 Server is not configured securelyHTC1087The SQL Server 2016 database is not configured securelyHTC1095The IBM z/OS version 2.3.x is not configured securelyHTC894The Apache 2.2 web server is not configured securelyHTC904The Apache 2.4 web server is not configured securelyHTC912The ESXi 6.0 hypervisor is not configured securelyHTC922The ESXi 6.5 hypervisor is not configured securelyHTC931The IIS 7.0 web server is not configured securelyHTC941The IIS 7.5 web server is not configured securelyHTC951The IIS 8.0 web server is not configured securelyHTC961The IIS 8.5 web server is not configured securelyHTC972The IBM DB2 v11 on z/OS is not configured securelyHTC982The IBM DB2 v12 on z/OS is not configured securelyHTC998The Cisco ASA 9.x (FW or VPN) is not configured securely) �% SCSEM Release Date: September 30, 2019HAC64]Multi-factor authentication is not required for internal privileged and non-privileged accessHAC65JMulti-factor authentication is not required for internal privileged accessHAC66NMulti-factor authentication is not required for internal non-privileged accessIMulti-factor authentication is not required for external or remote accessNMulti-factor authentication is not required to access FTI via personal devicesHRM20TMulti-factor authentication is not properly configured for external or remote accessHTC1107The SQL Server 2017 database is not configured securelyHTC1119The VMware ESXi 6.7 Hypervisor is not configured securelyHTC1127The Google Cloud environment is not configured securelyHTC1136The Azure Cloud environment is not configured securelyHTC114:The AWS Foundations environment is not configured securely�� c��`��g��� l����ITp{ � ���6+[.Bi/P|6c�8��9�N:5�:�=<r=5�>_ @� A�cB&CyD� .F� mG0 yH< IuJ�L�L�N�XOPIQ�S�#T�UdV�W�X�Z�s[z\](]^�T_�`"a}Cc�4d�0e� Jf� fg hs j�9k�rlmK�n�upDr�s-tGuIvYwlxhy�+{�Q|�y}�~�IȀCz��ƍA4��%��;��ѕL^ ��!AK�I����خ/�Y)�2��n���ϵ&K�tw��4��~��ý��9&�YC�v� ! �E f����u��cc��B����� ZO�� 1�!�  dMbP?_*+�%���# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M6Microsoft XPS Document Writer�X�� odXXLetter����DINU"L r SMTJMicrosoft XPS Document WriterInputBinFORMSOURCERESDLLUniresDLLInterleavingOFFImageTypeJPEGMedOrientationPORTRAITCollateOFFResolutionOption1PaperSizeLETTERColorMode24bpp MXDW�"d���?�?�&�U} I ]} � ]} i]} I ]1;;�����h@�@ � � � � �������������������� �N� \�� �M� ^�� �_�� �b� `�� ��� `�� ��� `�� ab�� c� d�� eO� f�� eP� f�� eQ� f�� eR� f�� eS� f�� gh��� i� j�� �� �� ��� �� �� �� �� �� ��� �� ��� �� �� �� �L� �� �/� �� ��� �� ��� ��� i2� j�� lmp� k � n� k � n�D�l   �@!�@"�#�$�%�&�'�(�*�+�,�.�`/�`0�`� k � n� !k � !o� "k � "n� #lm�� $k � $n� %k � %n� &k � &n� 'k � 'o� (k � (n� *�3� +��� ,��� .��� /��� 0���"p� �.��Y���( � ��� �Y � �A�:?��?�:�The official logo of the IRSPicture 1The official logo of the IRS"�҈PK!Z� [Content_Types].xmlN�0 HC�+jS8 @�%n�8QIM!��/b#� qX۲ P9mxD-GP�_6W�D#|? Aj+t0u:�z=aE�Y6g�=gO\^Usc3O"H'~4Jt71�>�*Ne"�34O7Ĭs{K��!J�$Qq M�dQK:lf�(vnv_`�4M�;Lt���PK!�� _rels/.relsj�0 }qNo^K �[IbHnھL`_Ŀ]fd � &G>� JMN� vi{ɖz$cȢ*%�2�-uAg�>zӶ/�3[0߀:r5�a8�>GT�8W�r>wOo?aΫ�Uv_��PK!?kwj drs/picturexml.xmlVn�6}/� �.KBElYE� `$�"J�^,;$%;n_<�!g܎t��42t RQk/� =Dx'zw�/<�4�=fJi/^Vw\pU�Un #VwbO8XBXã�Gp>� �7wp&Y�g�%�mO;�i�,' �%�=�/̠](8_%Az�:͗ Ҏb� xB�򐦚�5ؠ¸"'_�zm6m iJ&-�6NMhq�7w`64 c?c+#Pb:16A2OX��-з7ad�"l~_dDiaq ~*hRw�\AgDq^�&8\�wAI��م@ލ� �2|\fn�B7{ n�%aqj{�!Y�&�+%ϐ@SKKV_hp� �OٴCa^��j�1(*:"ʒxy�+�9;s&E ^*�7B�4jc`'\�9� Dž[+`dV7@(S~:a�)6E oԚ�hש�"kfn"Gji5о'm.~Dj�#5+{Y3�0,�&6{s,[3Mřx൹bm�",�0*WeeڴSz�-xJX{eC߹w�FDW�jό hiLߔ�ͺO_:ϭ��՛ֳ*ի�d~=qك۽rn}L=Q")))�,g%6�$.�(~f8x|G�=1�%1� "�;KaL!w�8يZdy(%,"ZB�f鴵�(�4\JV--� 8+x9|�o�=y�w�Oևo1|WF�o�9�h4�dqp56kWP�8>�7J( })�'�$8\�t�"\&�{r9|)��4� �JSkW�MjJBve |�>xW�?�3_T;F� ߶3>�b'{�j�-&VK)X�ܒ�[wBD86Xۊ�NORK�,"�*JK�z[6,goóIF7x�,bڮ~)w�-έf0�aC[cwnݱHGbo^rΓƠw @?�"�< /7�*kTK7e+600hG�K/)Xj\�Ir�`7VFd �0�|˗0o[мl�;�޻u3~�Y�+�#�#� ݈Je�-N�J�*"ݛ֔ƕ}�&0X ��!%?��"�c6^^^jR]J�|K�8gK keeج_)eݬ�tTz�_XAz ��VWӻE-�� f|rJH�1�9&UDG�.LXDI${J�30� o"Ψ"zɪ}`2E]Wz-%��;Yj�?`}ŔwX�#Io�G�>m e�ŻO�0q{He,H}Hs$M^xa�RT�2u�YuB�:DY:i_�#?�;� �CG�-C`סO/spC�nO� �5�� ~`_o]Gɗv�"� ^żd\צҶ{>�?�Հ܉�5~vyd~D7Gt���1痲sH~uwC:K�e\x+D⁰仡]doP_Kh$Rĭ{V�;ӆu.�2%�FZV/'�% ˹γWeEnߌF� ߢ^i߶1Xg!Oi ^� ],&Z׷uW|g[��kko^3cuDBy�䎋c^򍪚�$ٓ$fljK2 {K@�=yB bSI��ݭj�4Ho �M�� �7tl�+I�]'eڢmK�:34�5P�5g 8}LEloun탽l'�01�1XO�%R`~C)T4j�6`9�kE�r$X}Pa\Zש$H(I cz�8߮إmS} zH �1yVvd[=q�3�@ӍQnT�.zL��M!L�?t�8w�9� o =n�I̝w0_�k�;#|O�:sAS{:h|ч�ZV/+-G� �dJ�2/�&>nW� Zʜ-G��,<0ƯS,9�$r%t_E zs�,�>tml�+f�|%_ D�>⵼N� �6�?O�?Q � U;PA2 R� � xH�"}ֿ8Y� **�!mGȗ)Xv�9�;[��2 �lCsӹVB�+N?�0]���.]~ÜU*�&0 JDRP|hkeܜ `Rcf�>$ɪ�7<�+A�e 0G2�$�;Ag�2HI�9)Cț~ue)ɛ~�% ϟfB� x�%> �soL�=yDAwym]��0Mo�* �;^AV}4@�y%�$_k�n�)nBa`X�*rGvLIaZ7MeΓr;ުƁew�i� G�k@�?(6lĈ>[� � �:@d�ߍ_̇J�ud�|`�2CFK~r� כ߭�C7qd7iS'iO]xG~B/-xݨ_'�tq/ �: 76wɟkk&%мO_H�_)otCw%y�rn(�3��5GA��,ÿ[.Q5Q�7 #z1oP/_ݓ^ع}{G_Wuym���fK�>oLӘs�,z`�K0St@_TGb1M)C�(� DB�? U[�+H �H)W�&��rD!w�zC'E,jQ�!|�@~X3Jj�8ove�qr-5�'k{N�;u`BD�0w|6�&�_/HLQEz6�)Vմ�ѷP�E�Gk�8:L`Xxn�7�*�-ںx�:�?`06ʖ/�]��JBݦU�:o;(c�0�25^5ߐW^H�X]o��+Z~[� L2}r ׃GO���ltc!�9�pŰ�>*@H%kPH�i�pA%�� oՓmWI~.͔ݫxm3sp2 s5=Z~m7�-'/hX �0/Э�GMv}9Đz_�H�7.�x|˄ߍPmCiiX~z~e$��5 篷�+vK �,� �8.O� @/eL�L:mkWP� )gYI4 ͰNV]J� <4(� yHcown,�Ki�KR.S�%CA|X/ʬ]�"ƮN=�e 4�Bk�ۦC�mQsos��Y rd�CgL͸�7b-\�w,1ֵ g_C�&i]cPH.s�)\�,H_� ` `d?6J0R<� `�>E Hf{p0g+x|Wl�9w&�P#0Y�):4�&�t�/ޒU�x`�p KƆH�:C�̃D�% B�6��5gn/�zbAf�> rfҤ 5�QGkeJV=y�w̍:@?Co2A0ߏzECs=5�vxz/(sL8e{N� �5lXouUy$]J�>г�m�$&��.@=>�+� e㴑pV,/Ni�4�6�!opu�1A#�6hվ�Yk!^>x+�?g찭S�g&� >k˼AV#�5\=n� �,� `jF_l^Sz4�.;ay~860K�H[��gK^�?�10zai ,X`�g+��~� !T@=%__ӄ)�0.MgJ�?{w_� md�� �%d|?Tω�4W��&fv򛡆5kWOMҼV�`|Ń94ss�1�Xbk�3Ǒ%;a�A�*A�)�>~]jJ2|5rQ NP�<s�4Dn�~�(�& s� T/n{~փLZkO� �tGY�}:hCy�>}ʲ��,尪P?$ڲT2mնĹ�;帿7ρ%綊�<\M:N��އ\�)g�� m��!M}�*ǻa^&� Cwlp h�:M&i <1T0,٥�0h%=�}jwJ-�>�܌W.�~ܨջN)�TSL_eI󷾕4T�+�(.(JVOck>[� &~}@vE�-&>�SkZU;Gk|Oy.^-_}�/�.7�{�2 \ƞ#�QJϵ�RuVzg7� �,� 'Icp\�>{3�1݇Ӂr²Ѳֽ�|5ea'�;+价�!97�WQ͚:j�9�=� �9Hh�#Eo �Q5cJ?q7�$__ >tik>}�֣�6�ʶ!�+7��Mc< ҋڜa�""=YbHD�~:�,?wE )x"`��3QitOU|�*Za(�t(� I�يfsI[ݣ?H Caֿ>V |38c�({�7SB#˱fKZu�x�=IdkOADtuiL_M`7(� F0Q.bJM@� �8Jp�#iN5f dv_ ܼf-to![(d�%B=?~�$a�b�夡Sߕ [g EKֽkbw5oڜrq߹V@G߁;pdP'�W�3 V\֧\p� j`iûɅ[e1kUJ!|>� � =m*˟̼60oT~[`�GX#HJE�9�/,��*`Wf�$�zl(,� Ow�z<�ȑrꮭ| @/faj>p�6+`,.J z_U]j�2�!O0q1�CpVG>@o&�wpi ';b%�'Vi-� l�?{쫈<(|1Q5*�+� i|֭�Sޘ�A8�>R�Ɉ�1�R� ݧ�%H}V陫a*mհ� zIzFH�$2ZL�6~怖If{Š�Lep[I�<@gx`Mn·!ǾX�b+uCױqɺ8YFá� Kf# `yW+FGm5�d`0D?I3䑘ۿrUk|qNrg潨O1O�'e\D4VC]'ĽG��1Wb@\ ʋR &�A*]�=��!u �JcxN�6Q� �9SwT�--M�ǟB�>[ϲ�4`���ک5��3KUG^�sr� 4h�$N=-HR_W�$խ˹qS�n8BƊ]�ⅲ޲R�%֫y�c�6CJMm�-_{懳�'җz] 1~A |P ;XrZ#�?oE�``]W�4H^vN7K�.�*wFJ26~k9n ci.f�6ۼ�:ㇿ&VMP{U�-�$ރZn=0^׶miKfu]uٻcۢ^wm[ґ�݉.C-�:Ȓـ &A@g u9ɌS�)�:D*<��`mFzZD.Ŗr)�(Kwkr3Sj��9z�sx*�>xKL � KBwlq2s IDAT�bch͜{i}�DYr��/lf�`q1t&yU lBH͂� Cjmrŭw:]�@]V@N3�)y �xO@�8�T\2�H�4gx br=8W�/'ۏ>*� qN�oD=AD�ebk�.LOt� �,X��-%@��R�9nx�$ޑB�#I׃?@ouz5Z� �#zo.KW\rbwxS̿�e"߱W!FKcXU ��2q� Sgl`b�%�mҵ��)5�%[[9񤸜�,)�Jky�7ڋUJ<ɮ[� mfRiZI6R�)Rk Ћ{CR{]�$�%%�*Xiy_��'� ݑ̿귕:zicD{� Z�5�0y` ��zOI󄎎Oq_�O[~¯fq�2?a�܍��(=CmA�J-np6WQ�: k�/�B�ztDc Ⱦ� e&=]D� qf֑g�%,G\]�AqDL�EnBU��)|VѮކ.aY4y6|l�@ɭHjyJ �;ҥ�5U�>dycjjgeR Pf��S LBZ�('�9�1iCn u.JPa�/�;�<~� � /5�&{d�kgY)\`jlBJ�]͸ nlKd֬QVܯ.}_�G�3�X�-�+N5o_Olh b �%Pa֯Jo~6lhՁX@Y'�5lUd��2L{g)}A<~'�z�2$#�<-j*BPT�$u{\k�9~űe�iK{J�0�5ԯrq/Cc/E`鮙� k~E6�29DiE# FE�!jee#n]Urc {� �&e�>H x&p{�jy)�3褴ǪJ~ӽK�M?S�0y)��hhfCus̪YUN� lK#J.zg��,Bq}ە0��6T\�']ʑ�8Y;],'�$eYڥrj ì -Y1ݸAI^��1Rʧ앣jQ�w;W5C%61EJ#-LjRyhI�6lϰE��:�Y�3�&Bk =^߭ | H =N*r�*mՂr/aNhf�2� EsoGWe�4 s~|~ t`ːkB�62v�á���ǰ0GR�'n]!wo#�&� Ą�6^!JUF<* P�3D.+U�V&�5= �+�4h\�Mmj!�W� g�12s�*\#Ћt��";�5�S�l1֑o>~Eg�(S,reל@Rm�-`&@�uИAQ�(l�7ێp3z,eZ?*;Y��+S-��&Hj^ҿF xjY�pÙƞs�:_,}%A~ ,�'ˁ�eWW֫�/wQ:= I�=R�>g.l�:��=ͦKQdP/2kf ]U,�5><#؁J̴ͤ9OU�bKRIu6I rH<s�35`@l�Hy\[H]q?v�.7_$� M˪넒�ZKI4+�6 vRf58AO3OJW�dnVՕ�#a"L '} qr�cunצZll LO�#�n�'gZ&v�� 5`�SbxY}Rb� t^ ߇q�ZԮ)�.A�0l;N(a5w�+�-� �6[KU� PqB%�-bX��43� v�-V�>}\Sz ϗ y 8y1�;58&T� @� bL׺b3f*�?o;�.Cn,… eJBRZ)CL� Ľ�,y*�%�=H_�>J%}Pf/�"iڳ!8]�9_ݺ[ԼZ�}kXoV�T5^�=;o[[4Q� cn*ŒPuF/j=|[miQD2S�){�4y��*2�K�~eldZ�$,k $p{t̩U  y]t[iKB͊ff�!.B@�;�&6vt'Z_L_y�^�`� y��׬]ccVEUĻPS耭>s�>N`R�3}Sx+fݑH~erbKG0� *?0�.^O �[$2) ̫b\qez ki�;gzK!yGrB]�/4lu(�0UXZ�Nsv͝2BkkeəP�5AfGF� ?AءR GZ �;N+3m僣�a�0Rj�,-EY �oX�;Z'X{kI c_Δ@H=X˔@�ԉ]&�*Cn$!>b`�Ɗ@�L�S[�!Fc*m� Dnar0X P%P �[+ ˫X�?ӻ�Zˎea\n� ض�/�6u7դ�7u��?Y�>oXFy^?sdL\C1 �8Qy�4+CWbFæK=W�<�8R>ޜ2|Jڸl�,J% d,.6GScM�0� :Ex11`�\wpaH ��Ҡb)9q%H�-Kg{ �0P�pƇ#!�W}�� BNZŅ k�#_s0 k�uL76 [�Y*&�9P�( gj6�&TWSI�24ws�{�>󴥘?< ǵ€ 7a bt~X$v��b\\ ,4kEUulf5�s�`�,d%�(oY #,@.wϷjJG�'Jg �< ǰ�!8�:�+�sR@� �!@I�2cn�' �]�:,p� ��!ϵ~'^E/멐-�0X`�Lflu �M�+L֗Fe62n E�4�/<ɝx5u�du"�78jN�}��3ve&q݊u+~��NUeHrLEjtoB� JzZ�1ٔ۴�,U�" KJBB�( {!O+":IA2ֺիSF?�'x S`@'xF_sQOw�J m�lh5�Ov`" =�IW�iOJە� ;h�QFR2xQ14o˺�L2ES[#=�7rS�-`B�#^UsS�(��w �%:�8TvrILoyt0)(�ʰ�7V�5wHT��:aߴ~J� D� 5Ϭ%�ij,{q�>P5ݼ@:6v�2� 0KR^Z3�/u!Z|�'[�#�z $'m6r�p<~*Rui� �$tM�Az!tz�_{ߐ�w#bhNZq7;Yw9\~�M�6ȋ0Z�v`0[�0I�4� ["�%_}sx�;}A W�7,8�H>{9�<@:Co_gŒ�픲K�#1�P�6Wz|�__f>�?�r�:[�S� )�Oa,iH鉶6�(z SHi^w r�*UQko�!�>uYmz2RU쟐Q3�� T0B� ?�fx�yS � �,j�Q(Z$}7'�(Ld]Uw�8ixf�m4H�$Y9HYH�;Pj}:%2fDZ�-H_$K[�nq�m T� \ ~kC5v �%^7da'`Yc`/`M�1`S�Lmd2 PyO45dKuV�FQrCHJK  �;L FpA&Q&zJ%|F�r\M6�:A��7͗�*�N2}_�?JCr�=�ӡY�- -_M$[bQg5L��.< �9CKPꑶʶz�)�".AU�/Etå}�, {Kr ̋Hh)\�ܧo?YR 6æ)P=�6 YVjTw�%JBe�wlTyU v0E���5=rHB|� qm�z {<�j|SQqM�?TZK�:� UPW�.K� X�"yfju��=�3� 8ːr⢭3!M�߉>8@Lƒ c�?e;_T�Cn IDAT�+ u NJq�. >HYUqxI�0\#I�!)RUe�026�s@ޫCrRYI;�W^ SR�5Tk�&� �gCvW@_]%>Y$gi`� �3�&_},GI@ dWCT�7m�)r/M@JwʞQlZ|Z*9o�M1Fʌu1Udg�ITa��5`i9NBԌ@:3dK%eFmTMȍV� QBc|_|�%PX�Rz (EkNε�'η2Ln"^s G�Hjo�:T8+�:$' !Xh�9c�2`]JWA=G `k� ~~fn p'@�6�>=Zޡ�._� �2nS�4�L̴E�?�6uT: |Q0x S39YBT ;Z�L�CL-lM'=q`2)WYl�XK#W�>d�F~J ,0LJ?N�3BI%.FbƮ� �]I�:2U)l&��3`uo�o\�3��8:�4_�o%� @*oہzHta x�]~t}<]8SV&~ژLJ���s1x{QN^*J'�2Ep:�2ZDd�2np�/$N^ZC^=U- Ju`��>dMلVˢs�bwK_8*(kȺkU uK|Z{ߑnG�qlL^�$E3H�y24EDbܛ'W:�#*hEgʬC΀ԃYvkI3I�op?zh7⣑|�=?K 6#nN۶l%}�X:% ڽ�E ]Jh|cV�zOouW I=�"�SIw*uSom-j*Ҍr&h]J>v]l~!O�;> �4�]T&U:(V:چ|Ҁ�P2>`\jx�69H~�5�).b)�PN@jP� uc�7N�8w7hW�weܤr�$�� BZ!�2@�0o@�9[%1�a� :�+Cq�hpwgXH~N.aJ�oxhwp��0�:ZM�,L, : 5�7AG'ϐ"QPEp[9 E�#eMu*\2�=rZu;� �~�,_ '?�@A� ʯv(.U�4~^ju V"_Lm�G{u� q\N�rCMesd'*R6Q� �Š)j.�,ڡ2׉E� xӋP\q�*v#ke6`UP�eTJ�#&Y�>~R -��bD@�00XU_w2��*��3��"Xq./K�_R�P�&�( W8>Of6�ZOw�/XB�;M~5rM�$g±� {T.h��@nCZ�J zJƛB\�>βb` pڌZ�<�h\u�{2K̻�k�2q2 � N<�>N>XT=Qd`t�>�$Ac'�=�ض�{�Yt(�.#�vp~^j�� Nz"Q �5!�wr^�*�_L׃uRǶzYx� Bcsh�<$ftJԌ�4�;C6ï�x48mBD@n'U{k4N&�2H HSJӿ8#�,�*�x^IzKJf[EK~�6q�bT-ފk� ‰E_�,LTqgkq�35K7aAGɯ>\dßٴ{w�`Q/GXS1[2HT�:ҰV�(�� L~�)Gpns�5C�U�H�+Y �_�;qfث!`�0A�(l��!�'+G n?� �fG(G<|*C@�'M�љ{T]y R9$i�z٬I[fFt2� 䪅��)�=?|7JYOt��%e�?!k�[\�)?D|�#KHcqNbu9 n+uIuG4KlM/�&%B@J�8go%�(7 ?P#S^o/c{��3|SIn+CIW�#Y5o�;|^N]�*G� sF=|,ҴvuOIHV8�8:Y�M6Bb��B}a���;6Ej?4�(`�*t`AUРvf|�[뇍HdBlC�q��:ӣ$� S NJϩ�2hg�?7iy}Ƴ�-x*Y)wm ?�~v�X3S[[�A BD�#�.&ݥkz<�+~sdɎF0FUL؈.� ppWn^NҸ�->P{=�JP�z{խYM򊔃d"-kx�qbL�5 (@`�*KNM7d5YVlḽ>Jx_`@C 0}��8#�?A� �+gh4OPSTAA�1/&�:WJ7�&Y˱`'_ �_� E6Sjp@KoD&ei�;PY}'8�<2]:�M|��*fp>5E{¼1k�Ǹy<�;x>��>0~15%Ė}7^��Ta�=5p�Ѱ¹7�??l1֧5ؘٿg����$gcQDp_�u7K(H|8 ~\p8�;�7ˑ0d֛Mn#zHO`eM�Y�/� ��IUFis�\U��(tQ^mZ#)�/khV�'}N'i9{ ۧ.c\�h^3ռ%+? #;6-3dN�'P�$�!u!B�ݞd;~w��-~�ls� A#~j8�)Y5vvq�TT� BL�*[HT !ʐ$�/k 'e�?�E}FDA;i|YzdߝlS&x_ s7R%}[�r�V*ѰݸkwXط�6iMN3�-ŗ� �/�9LqF*n>"?ݳ#<'e^�od�B_BiP��xH\�9��.9IBaВyhh鬹`"Пud� Tnh�9v%hP"!p L%jipX�'pCy-� �g8VY^w=tuZ~0e58Q0DN^4KotQT�'�/`]a�2}�>ˊ˾dASTFIx�>tu �.|ӜX=;߲:99�*i� ϭxy[)[QHzr�0�>`EG!9YpN#�gxXRjd+�ar�9ҫ�5IMh,S� �dzA]|n�:�Bb" e�4�3el� 8"\&�&ݥ?xXfp11�,M"Q=1@0dƁll�>�S�*ƺܱ<BXٚ�_AE}�h�1B�}4�? @�� Kӡ]CPZzu��gټԏU�<*iEbCb53Sn>NP k%�dyy)Aʅ,��,Ze~B?,�r�+6� _ij�%Ŝ׉!W��@�Bqw�')�IE.�5z�R�|`e�% 'HFk� Ye�$n1IA�kV1�%DͱI�bT#�hn0wʝvo){wK矁mT�m|� >�<> Ѯ)e�Edx�>W'�js /o8IU\ky\xvrYڲp!^e~s\�>�3|h��7w�mܟpTl�7^ \-O$[�8;�,t�r�5�%M�*S˜?�:E{cR#wǍPJz��9-ţf�< �Bs,lj!}{bL�:1c'RV2x]�� Q9� L�8 ĘZMLM�$�L*K`nd7YeU)Y}=F� %7�-H_-wVQlgkɛ%x7��!�n�)@#�Q�_FmuRN�% Ut3߉3y�(`PgDf�rHB] �!!�&8^~� pW%�2P�8A�:܏ xTE�N�qy�H� �(�0�:��:ā~u w�mWVݳA�SRx!iz;m�\a*�8vZvCf yYE՞�.{g��?�-i6zXyØ\7؍OBhei�6M��2r08yh; k'{Iw8Jm4 4dyZr|VP8LAţ�3,tjA_�4 f}]-,SJ)�, _�.c RajAvX ˦�T-�:\߶|Ы� �kfFJU8tA_.ޮa6\Jkz�2\l\�JmHس}8o�9�2�2 "R�fISG�4{�S�\�2&��3y2kdqZWܡ%HVN:B_HJy�l)NJ��%aFBEeߢ�Ri+ĬG�F�'*�>R0PrMN+[V�(�i_�&.6IX[Sn]o�ڔ6ڛ5fzF[|C�زb�6LIV�;qp)C2?Q q{:���2�zJӺ6Bk r�爄\>�ڔ1oW>��1J_A�8O:cu\~W;s@M|:6W$2)LHvxS�jJ~󅲦{rfWbu([Q�1,Wd]nVA Ѹ�2mLA�́y,/ۼC�ʛU��);Zc�7rWhQ3}VRTO�/ej`֍@PEB�#0 oܞz~ d:0�n~ce1�.1T� �J0l�"�"EiOZYN"�v56a%�2d�QN � =VtZBO*�,�;�33g3q\�ηZ]Pz�"R Nϗ4W h(S}�(\“�ɧswt�9> p(1nbMBg\�DU%,st_{\p;U5�&�$2C>Xt6q�ܕP*.Ji�yW>d�X�7C�:�#x�9� s;Sz<�-M BN~yy�:_T[-#V�zBDnʛX_4FmH6D>Jf.�;f�0 ˍFz:ߤgYi�9ԞHV_XD̑꬙]4yΛiYU@jO�#x�$PӳlGϐ�$f}Խf%�?(cLB۞�ȓc5!`~SbH�?jryUU16O29p?�$7J=>t$s᭒�>zٖː�x٬�>&}�Ϸ[F,zΌiVJ>],�a_ӉK:Dמ�#�Ĥ}~S g&ӋlQS+,Zf;jF�+ FL� a}}⇥zy1E3Iq�9/oQ䘟H�'1S7%uHZoƢϒE-!F1�2*�7U8u�@�/�\X)�ή3]cBYR�;y 2TTog,T4�ר�[ǭ[b\V?� /N~E:ݘɗ6Ϻ�?aav`�� Hs� X �'�c� 4�64|X$�ё&S�6sR蓉o]ÓUxJ��J�4&kzLߖD�*CVS|KۇT�laJ0p�fA�36cf =Jqd_OSg�3 >4ȗa@*n v׿M;v\�4�.Y?){S>�a6~�I�x�H� 8ӈmmfpoi3ԛ�,�dPF.�M7| x)}?o׸kn'^�=v�4Da�"6Qu�09XLZ �FZR���3U'YyכCfJr�a!_t�G� �=||5+��mkrw�-RH})Lŏ;b3k6R~ѱ I&ARSޭ�;Pք@RG� ~uo{"jCڒ^�7�,ڸ۬"tdH$S�g�gEDG�65oSw��;ogxZ��QV93� |Z~tweBA�=�0~ q0vu^6QqL¤4D˵[kz_(,Qӳ�=�2OuE'�*�$�[AR�;w:hw�:X0M68D+wL l W܁͵^=Iý?MiM]b�+:G"�8� �JbXڞLVUw{w��uVQGT'rśwt��<�>E�)[� �?GST�0\oTu0sa)�?R�-Ǭa=īE�%2L�&m�6\#Ysl35w~S|HZr u�&��ƾ�)Z~ZLM�fhi�ۀq؊� zHnԇT́Bs{@�qn�[Z˼`$;pSV�-:u{�g p�+��q`+�>\]o�Z_}|;lP;uy�)� )rKLlzB^��Lv:R:�(i�1NGjSwl� Z6i@]1NrX0֯*>�,E*H%�,<&R�/ .򩛅Mp�+YV|5ެI\�#�#z<�2e*5B �/s/bfV�*]O�|�)3�!s@[�x �"w.�ђBWE0)c !S/T�=ze�$᣹f0Z!&gͶ!͂T/i{�-wɘV� U"��7 ~StO54d C7}#�#-H[�<$KB|ROۦkD�/� g(9l� O��$¨�V%Zc_P Yyy&~cA.%k~ӕU UD}W�?sAH� èlI?NDH>B'vDFYW KkH) UIwn#*iW�/�>9�!U�'�/\ʰ|�8�P�)e�;>Ypʏ@3@_E�T]6)h�#&8؇0�('F#�T:Q_�8A#~UJA~a�ifu8C� ~[KÍhj�*k�'�8W!|XBlFf$2cꂆ*{�Cjbi/İʁUL@fG6P�;eU#P�-n&)Gi@,Iv)I?�6#'dǤ:�4��UU~SAv �)GHGy-4�-|�.�3�@U0Elv|gLj_5+ddF݅ � +oq=@k#!%B�[Z�1yIgrŔu�hl�:ѻͤ�(�&j�0pK[Y.5&[|Crf_P0�8m%/Q;�?|cNk[Ӗ]/DXY�"Y(cP(E|�&SKd� o]R� 6�4S]ܧl1sU[8.mx^z:'�}�N t󙀼�XLg�-|�:όMp`vC�HlQv>!�7�<�0L1=u $�R%�GxA\s�2C�6sS&kc�)8c bWOz Mti� 9 �(*O�5 �@TnOeEWxƔ%YP �#q� ƣF�3fHz�-�vu_�CZc6ij?Ԫ�;S�5w^�!Y�9S�/�6UnФa;kh5Xl,+{�;X`N6v�]Ù J�?Hx~�6=*N>#g�5�:�YWCl�+׌@�0ݤl4`"�/�>txWa�3c{ 4խ9G�/I�=�-0P[ꅭY�OmfJ��!QKL(ؖmc\0ERM"?;XٓckS�)?v/%Kw)JpL4tT+{�?xʘG�)c�|seհ�07!GB�V�-Z�6U9$ "�4˱v4˄GD _(]H.3i) (| @Q%QgK_@C)y(2 !�>�$ٶ�<� !j ;#歱;W|y4Gk�rH >kO*OBs3c�GE�+*1rz߷ [no� ?h|O8h(?Q}ɼ=�k�%_N�XK}K @i�:z԰i^� �BS�1g}TBR$( njcQ`<.e>֥`b�$&Cה5f|�)-b�5Z3l|� [$D�2�=a8O�= ug" NjVޠtsM�'�,�85⊊e tɼ~@J0�v07dx@mwbYV�&)f� Y�7(B CJ΄/<�i)@yk�h>�u\ꩽ�J}p QvRl{kwh2�"P M%�!\bx2@z� � `xH"5Z|<�Σnm�j VY`':���1�%P,߰\BϔJ}tW�-_�)3mznUbfr�&J�bj�5ݔc~'9arx/�6 Q�8[udU96� K:/ITH?c۾́Yl�&Wv}��.,ujj@R.W5"급L`Slb^c�/OD`R��(ՑUk-[$oyg}t-G�3N�"g� � �11r[JRLD|QG~EKa�iqf �N蔶N~DiҲMstpI~uuWg+T`�_�<� �16Xג" @vdtyp ,9kAȥipߣ#ְݕմө<ң=bbwV�&r_;I2JCy�*YՃ�Ƅ�,r.�.&`VRuQ�3BBЊ�-^�9ζXr.畕x"x$ψߙR� @n~};�/�.,-N$9yڛO�ʘ9آe�?2�;;\ݯo}�4G1�{;�*QyxDHr;2* 'ͥ X_qDT"suC2ezSG}\IUBG#�IQ9�A *U�MI:Ʒ])@rr"8?]bSOf�4 c�:m�?lױ ��픱�>DҜ?�7uf�=)ҥϣ;�(UWKS� yKzJ�d� �/i6�3OdfZe{R�-YS-� �$߻sC\6��Zrjr6�1_AC�>�'*�4�ѥ߶mNxS[�5!~U m{ti)aڷI)� vFyٔ{6R(�)?~ܵ}\m�>m�z}�)=t^}_-̧pD'nRUh�}d܇.·��!�:"=>j\HY��'{!b6ᇂ`T�6)3�tlGd�4s/ϔɗՄʼ@3xc՛|ʷ/B�#�Bk�#ys�Uev� JwXM��-&#vp|He�`N\"D9If7�,_G4IOrub ~mES^k׮١U;J�t �����*�4i�0oE@r�8KQoPf*]"ʳ-O贵T,KG̽u)4G=c!ȕ9 /%x8� ޻_I=�☓4Edy4S�G�)pxYi]E(Ų7mH0HcY� I-#�&@?�=���*~)eXA״ u0{� "dk`RQq}gZQ^\̢R8+XJ_Rf܄H\�9$ʈm�2=3`xa(H@\X�<;M�@P����I �w����� �H #Insert tester name and organizationv�U�@ Insert complete agency nameon�@ Insert complete agency codeon�V 1Insert city, state and address or building number[g�A Insert date testing occurredbudi�F !Insert date of closing conferencei�R -Insert agency code(s) for all shared agencies�< Insert device/host name sre�f AInsert operating system version (major and minor release/version)�=sY�W )Select logical network location of device r %.0�; Insert device functionioof� Sheet1gg����D ZO�� Lz4�  dMbP?_*+�%���# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S� od��LetterPRIV� ''''��0\KhCFF���SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d���?�?�&�U} I } � }  } � } � } m } I } I } I �h�E��E�E�E�E�E���E ��E � �@ �@ �@�@�@�@�@�@�@�@�@�@� ���@�@�@� L4�$MMMMMMMMMMMMMMN� O�$PPPPPPPPPPPPPPQ� R��$SSSSSSSSSSSSSST�&RSSSSSSSSSSSSSST� RH�$SSSSSSSSSSSSSST� RI�$SSSSSSSSSSSSSST�&XUUUUUUUUUUUUUUV�&������������������ �������� �� ��� ��� ����� � ��� ����� �� ��� ��� ��� �� ��� ��� � Z� �� �� � � �+ ��;5��PassAZ+ � �;5��FailAZ+ � �;5��InfoAZ* � �;5��N/AAZ! �� D D � �� D�d� �� �% � �;5�B�! �6@� D D �% �6@ �;5�B� �� ��FFFFF� WWWWW� �� ��� ������ WWWWW��� ��� �$� �� �� �� ��� ��� ��� GGGGG��~ � @)��;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ p@��LLL�� �� LL� FFFFF��~ �@)��;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ p@��� FFFFF��~ �@)�@�;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ Y@i@��� FFFFF��~ �@)�@�;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ I@u@��� FFFFF��~ �@)�@�;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ $@4@��� FFFFF��~ �@)��;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ @��� FFFFF��~ �@)��;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ @)�DD�D�!� DD�� FFFFF��~ ��?)��?�;��@@DAZ?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�?��)#;��@@D�;��@@DB�~ �?)�?�DD�D�!� DD�� FFFFF��� ���5� �%��4�%��cd� FFFFF��&����������������!�6@ � D D �l��� �VSWARNING: THERE IS AT LEAST ONE TEST CASE WITH AN 'INFO' OR BLANK STATUS (SEE ABOVE)VSWARNING: THERE IS AT LEAST ONE TEST CASE WITH AN 'INFO' OR BLANK STATUS (SEE ABOVE)�*�$@�{*�aB�{����ebWARNING: THERE IS AT LEAST ONE TEST CASE WITH MULTIPLE OR INVALID ISSUE CODES (SEE TEST CASES TAB)ebWARNING: THERE IS AT LEAST ONE TEST CASE WITH MULTIPLE OR INVALID ISSUE CODES (SEE TEST CASES TAB)�>@0666*66**<X��.B��ppppp��q*� �  NI�PH ��0�( � �>�@Z��� �w�  ���;���  ���;������;�� �0�( � ���������� ������� ��?��0�( � ���������� ����D � �� ��?��0�( � ���������� ����D {U{ &��;�������({U{ &��;�������({+{ {�{���?�����(���� ��������� ������ @{�{���?�����(���� ��������� ������ @� Sheet4gg����D ZO�� +>�ث  dMbP?_*+�%���# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S� od��LetterPRIV�0''''��0\KhCFF���SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"d���?�?�&�U} I x} I x} I x+���}��������������� �� �� �� �� w������������������@���������@��@��@�@��@� y� qqqqqqqqqqqqr � z5� {{{{{{{{{{{{| � 4@� 5555555555556 �"78888888888889 �"78888888888889 �"78888888888889 �"78888888888889 �"78888888888889 �"78888888888889 �" 78888888888889 �" 78888888888889 �" 78888888888889 �" 78888888888889 �" 78888888888889 �":;;;;;;;;;;;;< � z� {{{{{{{{{{{{| � ~*� � �6����������� � ���� �7�vvvvvvvvvw � �+� ��� �&����������� � ~�� � ������������� � ~'� � �8����������� � ���� s9�tttttttttu � ���� �:�vvvvvvvvvw � ~(� � �;����������� � ���� �<�vvvvvvvvvw � ~,� � �=����������� � ���� �>�vvvvvvvvvw � �J� ��� �-����������� � ~K� � �?����������� � ���� �@�vvvvvvvvvw � ~)� � �A����������� �D l222&&&&&&&&&&&&2H<HHH<<H<H<HH< �!�"�#�$�@%�&�'�(�)�*�� ���� sB� tttttttttu � !���� !sE�!tttttttttu � "���� "sC�"tttttttttu � #���� #�D�#vvvvvvvvvw � $~.� $� $�F�$���������� � %���� %�G�%vvvvvvvvvw � &��� &��� &+��&,,,,,,,,,- �"'���./////////0 �"(���12222222223 � )��� )��� )+��),,,,,,,,,- �"*���12222222223 �R�<<<<H<H&&H�PH0��0�( � �>�@P���A �I �&( )*  �w� Sheet6gg����D ZO�� 3s�  dMbP?_*+�%���# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M�Adobe PDF��S� oA��LetterPRIV�0''''��0\KhCFF���SMTJ�Adobe PDF ConverterResolution1200dpiPageSizeLetterPageRegionLeadingEdgeInputSlotOnlyOne0EBDAStandard�"A���?�?�&�U} I ]} �]} �]} I]} I]} *]} �)]} ]} m ]} ]} � } � } I^�} I ]} �} I ]} ]} I ]tt� 3� @�*@�� ��� � � � �  ����� � �������� � � � � � � y$�qqqqqqqqq�� q� �� �� ��� �� �0� �T� �� �� ��  ��  ��  ���  ��� ��� c�  Q�  R�  S�  W�  ��  V�  [[ �  ���  T�  U��*��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� g� ^� �� V� d� e� f� K[�  K��  ���  A�  �B��* ��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� i� _� �� V� �� h� �� K[K �  ���  ��  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� m� _� �� V� j� k� l� K[K �  ���  ��  �C���?��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� o� Z� �� V� �� n� �� K[K �  ���  ��  �D��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� r� W� �� V� �� p� q� K[K �  ���  ��  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� v� W� �� V� s� t� u� K[K �  ���  ��  �E��@ ��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� z� X� �� V� w� x� y� K[K � ��� �� �F� �@ ��D �Fail D A�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� |� _� �� V� {� H� G� K[K � ��� �� �I� �@ ��D �Fail D A�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� � Y� �� V� }� ~� � K[K � ��� �� �F� �@ ��D �Fail D A�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� [� �� V� �� �� �� K[K � ��� �� �� �* �� ��D �Fail D A�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� �� �� V� �� �� �� K[K � ��� �� �J� �@��D �Fail D A�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� X� �� V� �� �� �� K[K �  ���  ��  �F��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� X� �� V� �� �� �� K[K �  ���  �  �K��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� `� �� V� �� �� �� K[K �  ���  L�  �M��*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� X� �� V� �� �� �� K[K �  ���  ��  �F��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� U� �� V� �� �� �� K[K �  ���  ��  �N��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� �� �� V� �� �� �� K[K �  ���  #�  �O��@��D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� \� �� V� �� �� �� K[K �  ���  ��  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� \� �� V� �� �� �� K[K �  ���  ��  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� ]� �� V� �� �� �� K[K �  ���  ��  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� �� �� �� V� �� �� �� K[K �  ���  P�  ����*����D�Fail DA�B%.;��@@E�� @ @;��@@B@"yD �Critical UD � Significant .D �Moderate  """B� ������������ ��  � �  � � ]�  � � ]�  � � ]�  � � ]�  � � ]�  � �D:%l:�{�{{{{{{{{{{{{{{{{{{{{.&(&& � !� "� #� $� %� &� '� (� )�*�+�,�-�.�/�0�1�2�� �� �  � !�!"#� $��$� %��%� &��&� '��'� (��()*+,-./012�*�h&  �  ����4@�#��( � �R� �# C ����� ��]F#! d �\�ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� � C ������]F! d ��ZR� �  C ����� �]F ! d ��ZR� �  C �����  �]F ! d ��ZR� �  C �����  �]F ! d ��ZR� �  C �����  �]F ! d ��ZR� �  C �����  �]F ! d �>�@P���A �I �w�  ����;� d � ���������*����Pass����;� d � ���������?���@Fail����;� d � �������������Info�����;� d � ���������*����Pass����;� d � ���������?���@Fail����;� d � �������������Info�  ����;� d � �������� ����LA{+{ {+{ {+{ {+{{+{{+{{�{  ���;�� �������� �������� ���������� ���#�/  %�/  %%( �/  %%( �/  %*- � Sheet2gg����DhDh   Range1h8h Range1_1_1h:h Range1_5_1_1h8h Range1_1_2h6h Range1_3h6h Range1_4h8h Range1_2_1 ZO�� /�  dMbP?_*����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������+�%���# &CIRS Office of Safeguards SCSEM&L&F&RPage &P of &N��&�?'�?(�?)�?M6Microsoft XPS Document Writer�X�� odXXLetter����DINU"L r SMTJMicrosoft XPS Document WriterInputBinFORMSOURCERESDLLUniresDLLInterleavingOFFImageTypeJPEGMedOrientationPORTRAITCollateOFFResolutionOption1PaperSizeLETTERColorMode24bpp MXDW�"d���?�?�&�U} I } mT} m���E������� � � � � ������������ L#� MMM� Y � Y!� Y"� Y1��$@�@@� �%� �a��4@�@� ��� �a���?�@� ��� �aH�?~ ��,@� ��� �a��^@�H@� ��� �a�H@`@�a@� ��� �a��a@�@� ��� �a� �@I@� ��� �a� @j@ @� �� a� �@j@�@� �P� �a� �@j@�@� ��� �a� �@j@�`@� ��� �a��@j@��-@� ��� �a~ @j@� �� �� aJJJJJJJJ�4R�8222<2222222228 �PHP� �0�( � � >�@P���A �w� Sheet8gg����D ZO�� P�C��O�$�-'7o@I�RG\enxg��  dMbP?_*+�%�����&ffffff�?'ffffff�?(�?)�?�"��333333�?333333�?�&�<3U} m } ^} � } � } $ } $ �;;;;;;;;; ; ; ; ; ;;;;;;;;;;;;;;;;;;;� �� �� �~ J[@� �� �~ @� �� �~ @� � ~ �?� � ~ @� � ~ @� � ~ @� �  ~ @�  �  ~ @�  �  ~ @ � �� ~ @ � � ~ @ � �� ~ @ � �� ~ @ � � ~ @� �� ~ �?� �� ~ @� � Q~  @� � ~ �?� � ~  @� � ~ @� � ~ @�  � !~ @� "� #~ @� $� %~ @� &� '~ @� (� )~ @� *� +~ @� �� ,~ @� -� .~ @� /� 0~ @� 1� 2~ @�D l8444444444444444444444444444444 ;!;";#;$;%;&;';(;);*;+;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;<;=;>;?;� 3� 4~ @ � !5� !6~ ! @!� "7� "8~ "�?"� #9� #:~ #@#� $;� $<~ $ @$� %=� %>~ %@%� &?� & @~ &!@&� 'A� 'B~ '@'� (C� (D~ (@(� )�� )E~ )@)� *F� *G~ *@*� +H� +I~ +@+� ,J� ,K~ ,@,� -L� -M~ -@-� .N� .O~ .@.� /P� /Q~ /@/� 0R� 0S~ 0@0� 1T� 1U~ 1@1� 2V� 2�~ 2@2� 3W� 3X~ 3@3� 4X� 4Y~ 4!@4� 5Z� 5[~ 5!@5� 6\� 6�~ 6!@6� 7]� 7^~ 7!@7� 8_� 8`~ 8!@8� 9a� 9b~ 9!@9� :�� :�~ :!@:� ;�� ;�~ ;!@;� <�� <�~ <@<� =�� =�~ =@=� >�� >�~ >@>� ?�� ?�~ ?@?�D l4444444444444444444444444444444@;A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S;T;U;V;W;X;Y;Z;[;\;];^;_;� @�� @�~ @@@� A�� A�~ A@A� B�� B�~ B@B� C�� C�~ C@C� DY� DZ~ D@D� E[� E~ E@E� F\� F]~ F@F� G^� G_~ G@G� H`� Ha~ H@H� Ib� Ic~ I@I� Jd� Je~ J@J� Kf� Kg~ K@K� Lh� Li~ L@L� Mj� Mk~ M@M� Nl� Nm~ N@N� On� Oo~ O@O� Pp� Pq~ P@P� Qr� Qs~ Q@Q� Rt� Ru~ R@R� Sv� Sw~ S@S� Tx� Ty~ T@T� Uz� U{~ U@U� V|� V}~ V@V� W~� W~ W@W� X� X~ X@X� Y�� Y�~ Y@Y� Z�� Z�~ Z@Z� [�� [�~ [@[� \�� \�~ \@\� ]�� ]�~ ]@]� ^�� ^�~ ^@^� _�� _�~ _@_�D l4444444444444444444444444444444`;a;b;c;d;e;f;g;hvi;j;k;l;m;n;o;p;q;r;s;t;u;v;w;x;y;z;{;|;};~;;� `�� `�~ `!@`� a�� a�~ a!@a� b�� b�~ b!@b� c�� c�~ c@c� d�� d�~ d@d� e�� e�~ e@e� f�� f�~ f@f� g�� g�~ g@g� hc� hd~ h@h� ie� if~ i@i� j�� j�~ j@j� k�� k~ k@k� l�� l�~ l@l� m�� m�~ m@m� n�� n�~ n@n� o�� o�~ o@o� p�� p�~ p@p� q�� q�~ q@q� r�� r�~ r@r� s�� s�~ s@s� t�� t�~ t@t� u�� u�~ u@u� v�� v�~ v@v� w�� w�~ w@w� x�� x�~ x@x� y�� y�~ y@y� z�� z�~ z"@z� {#�� {#�~ {$@{� |� |~ |@|� }#�� }#�~ }$@}� ~#�� ~#�~ ~$�?~� �� �~ %@�D l4444444444444444444444444444444;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;� �� �~ "@� ��� �#�~ �%@�� ��� �#�~ �!@�� ��� ��~ �!@�� ��� ��~ �!@�� ��� ��~ �!@�� ��� ��~ �"@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� �g~ �@�� ��� ��~ �"@�� ��� ��~ �@�� ��� ��~ ��?�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� �� �~ �@�� �� �~ �@�� �h� �i~ �@�� �j� �k~ �@�� ��� ��~ �@�� �l� �m~ �@�� �n� �o~ �@�� �p� �q~ �@��D l4444444444444444444444444444444�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�v�;�;�;�;�;� �r� �s~ �@�� �t� �u~ �@�� �v� �w~ �@�� �x� ��~ �@�� �y� �z~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� �#�� �#�~ �$@�� �#�� �#�~ �$@�� �#�� �#�~ �$@�� �� �~ �@�� ��� �~ �@�� �� �~ �@�� � � � ~ �@�� � � � ~ �@�� � � �~ �@�� �� �~ �@�� �� �~ �@�� �� �~ �@�� �� �~ �@�� �� �{~ �@�� �� �~ �@�� �� �~ �@�� �� �~ �@�� �� �|~ �@�� �}� �~~ �@�� �� �~ �@�� �� �~ �@�� � � �~ �@�� �!� �"~ ��?�� �#� �$~ �@��D l4444444444444444444444444444444�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;� ��� ��~ �@�� ��� ��~ �@�� �%� �&~ �@�� �'� �(~ �@�� �)� �*~ �@�� �+� �,~ �@�� �-� �.~ �@�� �/� �0~ �@�� �1� �2~ �@�� �3� �4~ �@�� �5� �6~ �@�� �7� �8~ �@�� �9� �~ �@�� �:� �;~ ��?�� �<� �=~ �@�� �>� �?~ �@�� �@� �A~ �@�� �B� �C~ �@�� �D� �E~ �@�� �F� �G~ ��?�� �H� �I~ ��?�� �R� �FS~ �@�� �J� �K~ �@�� �L� �M~ �@�� �N� �O~ �@�� �P� �Q~ �@�� �R� �S~ �@�� �T� �U~ �@�� ��� �V~ ��?�� �W� �X~ �@�� �Y� �Z~ �@�� �[� �\~ �@��D l4444444444444444444444444444444�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;� �]� �~ �@�� ��� �^~ �@�� �_� �`~ �@�� �a� �b~ �@�� �c� �d~ �@�� �e� �f~ �@�� �g� �h~ �@�� �i� �j~ �@�� �k� �l~ � @�� �m� �n~ �@�� �o� �p~ �@�� �q� �r~ �@�� �s� �t~ ��?�� �u� �v~ �@�� �w� �x~ �@�� �y� �~ �@�� �z� �{~ �@�� �|� �}~ �@�� �~� �~ �@�� �� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ � @�� ��� ��~ �@�� ��� �~ �@�� ��� ��~ �@�� ��� ��~ � @�� ��� ��~ �@�� ��� ��~ �@�� ��� ��~ �@��D l4444444444444444444444444444444;;;;;;;;; ; ; ; ; ;;;;;;;;;;;;;;;;;;;� �� �~ @� �� �~ @� �� �~ @� �� �~ @� �� �~  @� �� �~ @� �� �~ @� �� �~  @� �� �~ @� �� �~  @ � �� �~ @ � �� �~ @ � �� �~ @ � �� �~ @ � �� ~ @� �� �~ @� �� �~ @� �� �~ @� �� �~ @� �� �~ @� �� �~  @� �� �~ @� �� �~ @� �� �~  @� �� �~ @� �� �~ @� �� �~ @� �� �~ @� �� �~ @� �� �~ �?� �� �~ @� �� �~ @�D l4444444444444444444444444444444 ;!;";#;$;%;&;';(;);*;+;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;<;=;>;?;� �� �~ @ � !�� !�~ !@!� "�� "�~ "@"� #�� #�~ #@#� $�� $�~ $@$� %�� %�~ %@%� &�� &�~ &@&� '�� '�~ '@'� (�� (�~ (@(� )�� )�~ )@)� *�� *~ *@*� +�� +�~ +�?+� ,�� ,�~ ,@,� -�� -�~ -@-� .�� .�~ .@.� /�� /�~ /@/� 0�� 0�~ 0@0� 1�� 1�~ 1@1� 2�� 2�~ 2@2� 3�� 3�~ 3@3� 4#�� 4T~ 4@4� 5#�� 5�~ 5@5� 6#�� 6�~ 6@6� 7#�� 7�~ 7@7� 8#�� 8�~ 8@8� 9#�� 9�~ 9@9� :#�� :�~ :@:� ;#�� ;�~ ;@;� <#�� <�~ <@<� =#�� =�~ =@=� >#�� >�~ >@>� ?#�� ?�~ ?@?�D l4444444444444444444444444444444@;A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S;T;U;V;W;X;Y;Z;[;\;];^;_;� @#�� @�~ @@@� A�� A�~ A@A� B�� B�~ B@B� C�� C�~ C@C� D�� D�~ D@D� E�� E�~ E@E� F�� F�~ F@F� G�� G�~ G@G� H�� H�~ H@H� I�� I�~ I@I� J� J~ J@J� K� K~ K@K� L� L~ L@L� M� M~ M@M� N� N ~ N@N� O � O ~ O@O� P � P ~ P@P� Q� Q~ Q@Q� R� R~ R@R� S� S~ S@S� T� T~ T@T� U� U~ U@U� V� V�~ V@V� W&�� W&�~ W@W� X� X~ X!@X� Y� Y~ Y@Y� Z� Z#~ Z$@Z� [� [#~ [@[� \ � \�~ \!@\� ]!� ]"~ ]!@]� ^#� ^$~ ^@^� _%� _&~ _@_�D l4444444444444444444444444444444`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s;t;u;v;w;x;y;z;{;|;};~;;� `'� `(~ `@`� a)� a*~ a@a� b+� b,~ b@b� c-� c.~ c @c� d�� d�~ d@d� e�� e�~ e@e� f�� f�~ f@f� g�� g�~ g@g� h�� h�~ h@h� i�� i�~ i@i� j�� j�~ j@j� k�� k�~ k@k� l�� l�~ l@l� m/� m0~ m@m� n1� n~ n@n� o2� o3~ o@o� p4� p5~ p�?p� q6� q7~ q@q� r8� r�~ r@r� s9� s�~ s@s� t:� t;~ t@t� u<� u=~ u@u� v>� v?~ v@v� w'�� w'�~ w�?w� x'�� x'�~ x(�?x� y'�� y'~ y(@y� z'�� z'�~ z(�?z� {'�� {'�~ {(�?{� |'�� |'�~ |(�?|� }'�� }'�~ }(�?}� ~'�� ~'�~ ~(�?~� '�� '�~ (�?�D l4444444444444444444444444444444;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;� '�� '�~ (�?� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ ��?�� �'�� �'�~ ��?�� �'�� �'�~ ��?�� �'�� �'�~ ��?�� �'�� �'�~ ��?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'�� �'�~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'U~ �(�?�� �' � �' ~ �(�?�� �' � �' ~ �(�?�� �' � �'~ �(�?��D l4444444444444444444444444444444�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�;� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'~ �(�?�� �'� �'V~ �(�?�� �'� �'~ �(�?�� �' � �'!~ �(�?�� �'"� �'#~ �(�?�� �'$� �'%~ �(�?�� �'&� �''~ �(�?�� �'(� �')~ �(�?�� �'*� �'+~ �(�?�� �',� �'-~ �(�?�� �'.� �'/~ �(�?�� �'0� �'1~ �(�?�� �'2� �'3~ �(�?�� �'4� �'5~ �(@�� �'6� �'7~ �(@�� �'8� �'9~ �(�?�� �':� �';~ �(�?�� �'<� �'=~ �(�?�� �'>� �'?~ ��?�� �'@� �'A~ ��?�� �'B� �'C~ ��?�� �'D� �'E~ ��?�� �'F� �'G~ ��?�� �'W� �'X~ ��?�� �'Y� �'Z~ ��?�� �'[� �'\~ ��?��D l4444444444444444444444444444444�;�;�;�������������������������������������������������;�;�;�;�;� �']� �'^~ ��?�� �'_� �'`~ ��?�� �'a� �'b~ � @�� �'c� �'d~ �)�?�� �'e� �'f~ �)�?�� �'g� �'h~ �)�?�� �'i� �'j~ �)�?�� �'k� �'l~ �)�?�� �'m� �'n~ �)�?�� �'o� �'p~ �)�?�� �'q� �'r~ �)�?�� �'s� �'t~ �)�?�� �'u� �'v~ �)�?�� �'w� �'x~ �)�?�� �'y� �'z~ �)�?�� �'{� �'|~ �)�?�� �'}� �'~~ �)�?�� �'� �'~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'�� �'�~ �)�?�� �'H� �'I~ ��?�� �*J� �*K~ �(�?�� �*L� �*M~ �(�?�� �*N� �*O~ �(�?�� �*�� �*�~ �(�?��D l4444444444444444444444444444444�;�;�;�;�;�;�;�;�;� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?�� �*�� �*�~ �(�?����44444444�PH`��0�( � �>�@P���A �� Sheet3gg����D ��� ���  !"#$%&'()*+,-./0123456789:;<=>?���������������DocumentLibraryFormDocumentLibraryFormDocumentLibraryForm This value indicates the number of saves or revisions. The application is responsible for updating this value after each revision. � Oh+'0 hp����� � � ��� IRS Office of Safeguards SCSEM$IT Security Compliance EvaluationBooz Allen Hamiltonusgcb, stig, pub1075�The IRS SummaryInformation(���� ����c0DocumentSummaryInformation8������������tlCompObj�������������l������������strongly recommends agencies test all SCSEM settings in a development or test environment prior to deployment in production. In some cases a security setting may impact a systems functionality and usability. Consequently, it is important to perform testing to determine the impact on system security, functionality, and usability. Ideally, the test system configuration should match the production system configuration. Prior to making changes to the production system, agencies should back up all critical data files on the system and if possible, make a full backup of the system to ensure it can be restored to its pre-SCSEM state if necessary.Alobaidi, Ruda [USA]Microsoft Excel@/p+@s@i� ՜.+,D՜.+,t0 `h|�� ���� � �� securityOffice of SafeguardsInternal Revenue Service������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������  DashboardResults Instructions Test Cases Change LogIssue Code Table'Change Log'!Print_AreaDashboard!Print_AreaInstructions!Print_AreaResults!Print_Area'Test Cases'!Print_Area'Test Cases'!Print_Titles  Worksheets Named Ranges� h-5AMy��� � � � _PID_LINKBASE_NewReviewCycleSubject Keywords_Author _Category Categories Approval Level _Comments Assigned To�$IT Security Compliance Evaluationusgcb, stig, pub1075Booz Allen Hamilton securityThe IRS strongly recommends agencies test all SCSEM settings in a development or test environment prior to deployment in production. In some cases a security setting may impact a systems functionality and usability. Consequently, it is important to perf� ���� �F Microsoft Excel 2003 WorksheetBiff8Excel.Sheet.8�9q