{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["Instructions","Risk Findings","Values Lists"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Instructions","index":0,"n_rows":12,"n_cols":15,"rows_kept":12,"cut":false,"hidden":false,"merged":[[5,1,5,10],[7,1,7,10],[9,1,9,8],[11,1,11,7]]}
["Agency","Agency Finding Reference Field","Name","Finding","Affected Applications","Source Override","Policy - Section Name","Magnitude of Impact","Probability of Occurence","Finding Date","Actual Remediation Date","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Remediation Status"]
["Value Selection","Agency provided tracking ID","Name of finding","Description of finding","List the applications affected by this finding. Separate the application name by semi-colons.","Finding Origin. Value Selection","SEC501 Section ID. Value Selection. You may select multiple values.","Will this risk have a high, medium or low impact. Value Selection","Will this risk have a high, medium or low impact. Value Selection ","The date when the finding was submitted to CSRM. The date format is MM/DD/YYYY","This date is used to calculate closure. The date format is MM/DD/YYYY","Description of remediation steps to be taken","When will the remediation be completed. The date format is MM/DD/YYYY","Who is responsible for the remediation. If listing multiple people, please separate them by semi-colons.","Value Selection"]
[]
[]
[null,"Instructions:"]
[null,"Please fill out Risk Findings tab and send in to commonwealthsecurity@vita.virginia.gov"]
[]
[null,"This sheet is intended to provide a description of each field header.  If it is labeled \"Value Selection\", that indicates that a value can be selected from a drop-down menu."]
[]
[null,"Also the Headings on each column will provide a description and any special comumn formatting"]
[]
[null,"All columns highlighted are required"]

{"sheet":"Risk Findings","index":1,"n_rows":1,"n_cols":15,"rows_kept":1,"cut":false,"hidden":false,"merged":[]}
["Agency","Agency Finding Reference Field","Name","Finding","Affected Applications","Source Override","Policy - Section Name","Magnitude of Impact","Probability of Occurence","Finding Date","Actual Remediation Date","Remediation Overview","Initial Planned Due Date","Responsible Person(s)","Remediation Status"]

{"sheet":"Values Lists","index":2,"n_rows":305,"n_cols":6,"rows_kept":305,"cut":false,"hidden":false,"merged":[]}
["Agency Name","Risk Values","Policy - Section Name","Source Override","Remediation Status","Risk ID"]
["Alcoholic Beverage Control","High","AC-01 Access Control Policy and Procedures","Audit","Not Started","RSK-1 Access Control"]
["ATOS","Medium","AC-02 Account Management","Risk","Underway","RSK-2 Access Enforcement"]
["Board of Accountancy","Low","AC-03 Access Enforcement","Scans","Complete","RSK-3 Account Management"]
["Center for Innovative Technologies",null,"AC-04 Information Flow Enforcement",null,null,"RSK-4 Application Management"]
["Commonwealths Attorneys Services Council",null,"AC-05 Separation of Duties",null,null,"RSK-5 Automation Strategy"]
["Compensation Board",null,"AC-06 Least Privilege",null,null,"RSK-6 Change Management"]
["Department for Aging and Rehabilitative Services",null,"AC-07 Unsuccessful Login Attempts",null,null,"RSK-7 Communication Channels"]
["Department for the Deaf and Hard of Hearing",null,"AC-08 System Use Notification",null,null,"RSK-8 Configuration Management"]
["Department of Accounts",null,"AC-08-COV System Use Notification",null,null,"RSK-9 Data Retention, Backup and Recovery"]
["Department of Aviation",null,"AC-09 Withdrawn",null,null,"RSK-10 Exception Management"]
["Department of Behavioral Health and Development Services",null,"AC-10 Withdrawn",null,null,"RSK-11 Executive Sponsorship"]
["Department of Conservation and Recreation",null,"AC-11 Session Lock",null,null,"RSK-12 External Compliance"]
["Department of Corrections",null,"AC-12 Session Termination",null,null,"RSK-13 External Service Provider Management"]
["Department of Criminal Justice Services",null,"AC-13 Withdrawn",null,null,"RSK-14 Final Solution Delivery"]
["Department of Education",null,"AC-14 Permitted Actions Without Identification Or Authentication",null,null,"RSK-15 Financial Oversight"]
["Department of Elections",null,"AC-15 Withdrawn",null,null,"RSK-16 Findings Management"]
["Department of Environmental Quality",null,"AC-16 Withdrawn",null,null,"RSK-17 Functional Oversight"]
["Department of Fire Programs",null,"AC-17 Remote Access",null,null,"RSK-18 Incident Management"]
["Department of Forensic Science",null,"AC-17-COV Remote Access",null,null,"RSK-19 Information Classification and Protection"]
["Department of Forestry",null,"AC-18 Wireless Access",null,null,"RSK-20 Internal Controls"]
["Department of General Services",null,"AC-18-COV Wireless Access",null,null,"RSK-21 Internal Service Level Agreements"]
["Department of Health Professions",null,"AC-19 Access Control for Mobile Devices",null,null,"RSK-22 Governance Monitoring"]
["Department of Historic Resources",null,"AC-20 Use of External Information Systems",null,null,"RSK-23 Least Privilege"]
["Department of Housing and Community Development",null,"AC-20-COV Use of External Information Systems",null,null,"RSK-24 Management Commitment"]
["Department of Human Resource Management",null,"AC-21 Withdrawn",null,null,"RSK-25 Operational Cost Management"]
["Department of Juvenile Justice",null,"AC-22 Publicly Accessible Content",null,null,"RSK-26 Operations Management"]
["Department of Labor and Industry",null,"AC-23 Withdrawn",null,null,"RSK-27 Performance and Capacity Management"]
["Department of Medical Assistance Services",null,"AC-24 Withdrawn",null,null,"RSK-28 Performance Monitoring"]
["Department of Military Affairs",null,"AC-25  Withdrawn",null,null,"RSK-29 Policy Management"]
["Department of Mines, Minerals and Energy",null,"AT-01 Security Awareness and Training Policy and Procedures",null,null,"RSK-30 Problem Management"]
["Department of Motor Vehicles",null,"AT-02 Security Awareness",null,null,"RSK-31 Procurement"]
["Department of Planning and Budget",null,"AT-02-COV Security Awareness",null,null,"RSK-32 Project Management"]
["Department of Professional and Occupational Regulation",null,"AT-03 Security Training",null,null,"RSK-33 Protection of Physical Assets"]
["Department of Rail and Public Transportation",null,"AT-04 Security Training Records",null,null,"RSK-34 Quality Management"]
["Department of Small Business and Supplier Diversity",null,"AT-05 [Withdrawn: Incorporated into PM-15].",null,null,"RSK-35 Regulatory Commitment"]
["Department of Social Services",null,"AU-01 Audit and Accountability Policy and Procedures",null,null,"RSK-36 Risk Management"]
["Department of Taxation",null,"AU-02 Auditable Events",null,null,"RSK-37 Security Management"]
["Department of Treasury",null,"AU-03 Content of Audit Records",null,null,"RSK-38 Separation of Duties - Responsibilities"]
["Department of Veterans Services",null,"AU-04 Audit Storage Capacity",null,null,"RSK-39 Separation of Duties - Technical"]
["Department of Wildlife Resources",null,"AU-05 Response To Audit Processing Failures",null,null,"RSK-40 Business Continuity and Service Availability"]
["Frontier Culture Museum of Virginia",null,"AU-06 Audit Review, Analysis, and Reporting",null,null,"RSK-41 Human Resources Management"]
["Gunston Hall",null,"AU-07 Withdrawn",null,null,"RSK-42 Strategic Direction"]
["Indigent Defense Commission",null,"AU-08 Time Stamps",null,null,"RSK-43 Technology Documentation"]
["Iron Bow",null,"AU-09 Protection of Audit Information",null,null,"RSK-44 Technology Infrastructure Management"]
["Jamestown-Yorktown Foundation",null,"AU-10 Withdrawn",null,null,"RSK-45 Technology Strategy"]
["Library of Virginia",null,"AU-11 Audit Record Retention",null,null,"RSK-46 Training and education"]
["Marine Resources Commission",null,"AU-12 AUDIT GENERATION",null,null,"RSK-47 Legal/Matters Management"]
["Motor Vehicle Dealer Board",null,"AU-13 MONITORING FOR INFORMATION DISCLOSURE",null,null,"RSK-48 Facilities Management"]
["Norfolk State University",null,"AU-14 Withdrawn",null,null,"RSK-49 Customer Delivery"]
["Office of Attorney General",null,"AU-15 Withdrawn",null,null,"RSK-50 Privacy"]
["Office of Children's Services",null,"AU-16 Withdrawn",null,null,"RSK-51 Financial transactions not recorded."]
["Office of State Inspector General",null,"CA-01 Security Assessment and Authorization Policies and Procedures",null,null,"RSK-52 Enterprise-Class Controls"]
["Office of the Governor",null,"CA-02 Withdrawn",null,null,"RSK-53 Enterprise-class Security controls"]
["Perspecta",null,"CA-03 Information System Connections",null,null,"RSK-54 Enterprise Class Security Controls"]
["Richard Bland College ",null,"CA-03-COV Information System Connections"]
["SAIC",null,"CA-04 Withdrawn"]
["Science Museum of Virginia",null,"CA-05 Withdrawn"]
["Southern Virginia Higher Education Center",null,"CA-06 Security Authorization"]
["Southwest Virginia Higher Education Center",null,"CA-07 Continuous Monitoring"]
["State Corporation Commission",null,"CA-08 Penetration Testing"]
["State Council of Higher Education for Virginia",null,"CA-09 Withdrawn"]
["State Lottery Department",null,"CM-01 Configuration Management Policy and Procedures"]
["Tempus Nova",null,"CM-02 Baseline Configuration"]
["Tobacco Region Revitalization Commission",null,"CM-02-COV Baseline Configuration"]
["Unisys",null,"CM-03 Configuration Change Control"]
["Verizon",null,"CM-03-COV Configuration Change Control"]
["Virginia College Savings Plan",null,"CM-04 Security Impact Analysis"]
["Virginia Commission for the Arts",null,"CM-05 Access Restrictions for Change"]
["Virginia Department of Agriculture and Consumer Services",null,"CM-06 Configuration Settings"]
["Virginia Department of Emergency Management",null,"CM-07 Least Functionality"]
["Virginia Department of Health",null,"CM-08 Information System Component Inventory"]
["Virginia Department of Transportation",null,"CM-09 Configuration Management Plan"]
["Virginia Economic Development Partnership",null,"CM-10 Software Usage Restrictions"]
["Virginia Employment Commission",null,"CM-11 USER-INSTALLED SOFTWARE"]
["Virginia Foundation for Healthy Youth",null,"CP-01 Contingency Planning Policy and Procedures"]
["Virginia Information Technologies Agency",null,"CP-01-COV-1 Contingency Planning Policy and Procedures"]
["Virginia Museum of Fine Arts",null,"CP-01-COV-2 Contingency Planning Policy and Procedures"]
["Virginia Museum of Natural History",null,"CP-02 Contingency Plan"]
["Virginia Racing Commission",null,"CP-03 Contingency Training"]
["Virginia Resources Authority",null,"CP-04 Contingency Plan Testing and Exercises"]
["Virginia Retirement System",null,"CP-05 Withdrawn"]
["Virginia School for the Deaf and Blind",null,"CP-06 Alternate Storage Site"]
["Virginia State Police",null,"CP-07 Alternate Processing Site"]
["Virginia State University",null,"CP-08 Telecommunications Services"]
["Virginia Workers Compensation Commission",null,"CP-09 Information System Backup"]
["Xerox",null,"CP-09-COV Information System Backup"]
[null,null,"CP-10 Information System Recovery and Reconstitution"]
[null,null,"CP-11 Withdrawn"]
[null,null,"CP-12 Withdrawn"]
[null,null,"CP-13 Withdrawn"]
[null,null,"GOV-1.03 Roles and Responsibilities"]
[null,null,"GOV-1.04 Information Security Program"]
[null,null,"GOV-1.05 Exceptions to Security Requirements"]
[null,null,"GOV-1.06 Exemptions from Applicability"]
[null,null,"GOV-1.07 Determination of Liability"]
[null,null,"GOV-1.08 Withdrawn"]
[null,null,"GOV-1.09 Revocation of Hosted Computing"]
[null,null,"GOV-2.02 CIO; Role"]
[null,null,"GOV-2.03 CISO; Role"]
[null,null,"GOV-2.04 Agency Head; Role"]
[null,null,"GOV-2.05 ISO; Role"]
[null,null,"GOV-2.06 Privacy Officer ; Role"]
[null,null,"GOV-2.07 System Owner; Role"]
[null,null,"GOV-2.08 Data Owner; Role"]
[null,null,"GOV-2.09 System Administrator; Role"]
[null,null,"GOV-2.10 Data Custodian; Role"]
[null,null,"GOV-2.11 IT System Users"]
[null,null,"GOV-3.x BIA Requirements"]
[null,null,"GOV-4.x Data Sensitivity Classification"]
[null,null,"GOV-5.x Sensitive IT System Inventory and Definition"]
[null,null,"GOV-6.x Risk Assessments"]
[null,null,"GOV-7.x IT Security Audits"]
[null,null,"IA-01 Identification and Authentication Policy and Procedures"]
[null,null,"IA-02 Identification and Authentication (Organizational Users)"]
[null,null,"IA-02-COV Identification and Authentication (Organizational Users)"]
[null,null,"IA-03 Withdrawn"]
[null,null,"IA-04 Identifier Management"]
[null,null,"IA-05 Authenticator Management"]
[null,null,"IA-05-COV-01 Authenticator Management"]
[null,null,"IA-05-COV-02 Authenticator Management"]
[null,null,"IA-06 Authenticator Feedback"]
[null,null,"IA-07 Cryptographic Module Authentication"]
[null,null,"IA-08 Identification and Authentication (Non-organizational Users)"]
[null,null,"IA-09 Withdrawn"]
[null,null,"IA-10 Withdrawn"]
[null,null,"IA-11 Withdrawn"]
[null,null,"IR-01 Incident Response Policy and Procedures"]
[null,null,"IR-01-COV Control: \n\nThe organization:"]
[null,null,"IR-02 Incident Response Training"]
[null,null,"IR-03 Incident Response Testing and Exercises"]
[null,null,"IR-04 Incident Handling"]
[null,null,"IR-04-COV Incident Handling"]
[null,null,"IR-04-COV-1 Incident Handling"]
[null,null,"IR-04-COV-2 Incident Handling"]
[null,null,"IR-05 Incident Monitoring"]
[null,null,"IR-05-COV Incident Monitoring"]
[null,null,"IR-06 Incident Reporting"]
[null,null,"IR-06-COV Incident Reporting"]
[null,null,"IR-07 Incident Response Assistance"]
[null,null,"IR-08 Incident Response Plan"]
[null,null,"IR-09 Information Spillage Response"]
[null,null,"IR-10 Withdrawn"]
[null,null,"MA-01 System Maintenance Policy and Procedures"]
[null,null,"MA-02 Controlled Maintenance"]
[null,null,"MA-03 Withdrawn"]
[null,null,"MA-04 Withdrawn"]
[null,null,"MA-05 Maintenance Personnel"]
[null,null,"MA-06 Timely Maintenance"]
[null,null,"MP-01 Media Protection Policy and Procedures"]
[null,null,"MP-01-COV Media Protection Policy and Procedures"]
[null,null,"MP-02 Media Access"]
[null,null,"MP-03 Media Marking"]
[null,null,"MP-04 Media Storage"]
[null,null,"MP-04-COV Media Storage"]
[null,null,"MP-05 Media Transport"]
[null,null,"MP-06 Media Sanitization"]
[null,null,"MP-06-COV Media Sanitization"]
[null,null,"MP-07 Media Use"]
[null,null,"PE-01 Physical and Environmental Protection Policy and Procedures"]
[null,null,"PE-01-COV Physical and Environmental Protection Policy and Procedures"]
[null,null,"PE-02 Physical Access Authorizations"]
[null,null,"PE-02-COV Physical Access Authorizations"]
[null,null,"PE-03 Physical Access Control"]
[null,null,"PE-03-COV Physical Access Control"]
[null,null,"PE-04 Access Control For Transmission Medium"]
[null,null,"PE-05 Access Control for Output Devices"]
[null,null,"PE-06 Monitoring Physical Access"]
[null,null,"PE-07 Withdrawn"]
[null,null,"PE-08 Access Records"]
[null,null,"PE-09 Power Equipment and Power Cabling"]
[null,null,"PE-10 Emergency Shutoff"]
[null,null,"PE-11 Emergency Power"]
[null,null,"PE-12 Emergency Lighting"]
[null,null,"PE-13 Fire Protection"]
[null,null,"PE-14 Temperature and Humidity Controls"]
[null,null,"PE-15 Water Damage Protection"]
[null,null,"PE-16 Delivery and Removal"]
[null,null,"PE-17 Alternate Work Site"]
[null,null,"PE-18 Location of Information System Components"]
[null,null,"PE-18-COV  Location of Information System Components"]
[null,null,"PE-19 Withdrawn"]
[null,null,"PE-20 Withdrawn"]
[null,null,"PL-01 Security Planning Policy and Procedures"]
[null,null,"PL-02 System Security Plan"]
[null,null,"PL-02-COV System Security Plan"]
[null,null,"PL-03 Withdrawn"]
[null,null,"PL-04 Rules of Behavior"]
[null,null,"PL-04-COV Rules of Behavior"]
[null,null,"PL-05 Withdrawn"]
[null,null,"PL-06 Withdrawn"]
[null,null,"PL-07 Withdrawn"]
[null,null,"PL-08 Information Security Architecture"]
[null,null,"PL-09 Withdrawn"]
[null,null,"PS-01 Personnel Security Policy and Procedures"]
[null,null,"PS-02 Withdrawn"]
[null,null,"PS-03 Personnel Screening"]
[null,null,"PS-04 Personnel Termination"]
[null,null,"PS-05 Personnel Transfer"]
[null,null,"PS-06 Access Agreements"]
[null,null,"PS-07 Third-party Personnel Security"]
[null,null,"PS-08 Personnel Sanctions"]
[null,null,"RA-01 Risk Assessment Policy and Procedures"]
[null,null,"RA-02 Security Categorization"]
[null,null,"RA-03 Risk Assessment"]
[null,null,"RA-04 Withdrawn"]
[null,null,"RA-05 Vulnerability Scanning"]
[null,null,"SA-01 Systems & Services Acquisions Policies"]
[null,null,"SA-02 Allocation of Resources"]
[null,null,"SA-03 Life Cycle Support"]
[null,null,"SA-03-COV Life Cycle Support"]
[null,null,"SA-03-COV-1 Life Cycle Support"]
[null,null,"SA-03-COV-2 Life Cycle Support"]
[null,null,"SA-04 Withdrawn"]
[null,null,"SA-04-COV-1"]
[null,null,"SA-05 Information System Documentation"]
[null,null,"SA-06 Withdrawn"]
[null,null,"SA-06-COV Software Usage Restrictions"]
[null,null,"SA-07 Withdrawn"]
[null,null,"SA-08 Security Engineering Principles"]
[null,null,"SA-09 External Information System Services"]
[null,null,"SA-09-COV-1 External Information System Services"]
[null,null,"SA-09-COV-2 External Information System Services"]
[null,null,"SA-09-COV-3 External Information System Services"]
[null,null,"SA-10 Developer Configuration Management"]
[null,null,"SA-11 Developer Security Testing"]
[null,null,"SA-12 Withdrawn"]
[null,null,"SA-13 Withdrawn"]
[null,null,"SA-14 Withdrawn"]
[null,null,"SA-15 Development  Process, Standards, and Tools"]
[null,null,"SA-16 Developer-Provided Training"]
[null,null,"SA-17 Developer Security Architecture And Design"]
[null,null,"SA-18 Withdrawn"]
[null,null,"SA-19 Withdrawn"]
[null,null,"SA-20 Withdrawn"]
[null,null,"SA-21 Withdrawn"]
[null,null,"SA-22 Unsupported System Components"]
[null,null,"SC-01 System and Communications Protection Policy and Procedures"]
[null,null,"SC-02 Application Partitioning"]
[null,null,"SC-03 Security Function Isolation"]
[null,null,"SC-04 Information In Shared Resources"]
[null,null,"SC-05 Denial of Service Protection"]
[null,null,"SC-06 Resource Priority"]
[null,null,"SC-07 Boundary Protection"]
[null,null,"SC-08 Transmission Integrity"]
[null,null,"SC-08-COV Transmission Integrity"]
[null,null,"SC-09 Withdrawn"]
[null,null,"SC-10 Network Disconnect"]
[null,null,"SC-11 Withdrawn"]
[null,null,"SC-12 Cryptographic Key Establishment and Management"]
[null,null,"SC-12-COV Cryptographic Key Establishment and Management"]
[null,null,"SC-13 Use of Cryptography"]
[null,null,"SC-13-COV Use of Cryptography"]
[null,null,"SC-14 Withdrawn"]
[null,null,"SC-15 Collaborative Computing Devices"]
[null,null,"SC-16 Withdrawn"]
[null,null,"SC-17 Public Key Infrastructure Certificates"]
[null,null,"SC-18 MOBILE CODE"]
[null,null,"SC-19 VOICE OVER INTERNET PROTOCOL"]
[null,null,"SC-20 Secure Name / Address Resolution Service (Authoritative Source)"]
[null,null,"SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver)"]
[null,null,"SC-22 Architecture and Provisioning for Name / Address Resolution Service"]
[null,null,"SC-23 Session Authenticity"]
[null,null,"SC-24 Withdrawn"]
[null,null,"SC-25 Withdrawn"]
[null,null,"SC-26 Withdrawn"]
[null,null,"SC-27 Withdrawn"]
[null,null,"SC-28 Protection of Information At Rest"]
[null,null,"SC-29 Withdrawn"]
[null,null,"SC-30 Withdrawn"]
[null,null,"SC-31 Withdrawn"]
[null,null,"SC-32 Withdrawn"]
[null,null,"SC-33 Withdrawn"]
[null,null,"SC-34 Withdrawn"]
[null,null,"SC-37 Protection of Out-Of-Band Channels"]
[null,null,"SC-38 Withdrawn"]
[null,null,"SC-39 Process Isolation"]
[null,null,"SC-40 Withdrawn"]
[null,null,"SC-41 Port And I/O Device Access"]
[null,null,"SC-42 Sensor Capability and Data"]
[null,null,"SC-42-COV Sensor Capability and Data"]
[null,null,"SC-43 Usage Restrictions"]
[null,null,"SC-44 Withdrawn"]
[null,null,"SI-01 System and Information Integrity Policy And Procedures"]
[null,null,"SI-02 Flaw Remediation"]
[null,null,"SI-02-COV Flaw Remediation"]
[null,null,"SI-03 Malicious Code Protection"]
[null,null,"SI-03-COV Malicious Code Protection"]
[null,null,"SI-04 Information System Monitoring"]
[null,null,"SI-05 Security Alerts, Advisories, and Directives"]
[null,null,"SI-06 Security Functionality Verification"]
[null,null,"SI-07 Software and Information Integrity"]
[null,null,"SI-08 Spam Protection"]
[null,null,"SI-08-COV Spam Protection"]
[null,null,"SI-09 [Withdrawn: Incorporated into AC-2, AC-3, AC-5, AC-6]."]
[null,null,"SI-10 Information Input Validation"]
[null,null,"SI-11 Error Handling"]
[null,null,"SI-12 Information Output Handling and Retention"]
[null,null,"SI-13 Withdrawn"]
[null,null,"SI-14 Withdrawn"]
[null,null,"SI-15 Withdrawn"]
[null,null,"SI-16 Memory Protection"]
[null,null,"SI-17 Withdrawn"]
[null,null,"SI-16 Memory Protection"]
[null,null,"SI-17 Withdrawn"]