WGU D486 DFN1 Task 1: Governance, Risk, and Compliance Security Assessment for FMC 2026 update

Prepared by Pruhart Security Consulting FOR OFFICIAL USE ONLY Document Revision History The security assessment report (SAR) is a living document that is changed as required to reflect system, operational, or organizational changes. Modifications made to this document are recorded in the version history matrix below. At a minimum, this document will be reviewed and assessed annually. Reviews made as part of the assessment process shall also be recorded below. This document history shall be maintained throughout the life of the document and the associated system. Date Description Version Author 01/05/20XX Document Publication 1.0 Sophia Martin ) PAGE 2 DFN1 Task 1: Governance, Risk, and Compliance Security Assessment Report Date Description Version Author ) PAGE 3 DFN1 Task 1: Governance, Risk, and Compliance Security Assessment Report From: Sophia Martin, Head Consultant, Pruhart Security Consulting To: Board of Directors, Fielder Medical Center (FMC) On behalf of Pruhart Security Consulting, I would like to thank you for the opportunity to provide a security audit and assessment for FMC. We have finalized our preliminary reporting and are disseminating our findings below for your review. Our key findings indicate FMC needs specialized support in updating and modernizing its network and internal controls to address the changing landscape of laws, regulations, and standards that apply to federal government compliance. Specifically, FMC needs to address the following: 1. There is a lack of security controls and policies, including access control policies and procedures, account management, least privilege, and security attributes. 2. The systems design is outdated, requiring immediate attention to remediate gaps between the previous and outdated systems security plan (SSP) and compliance requirements. 3. Security and privacy plans need to be updated to reflect the organizational needs and requirements. This includes: a. an information security program plan based on compliance and the organization’s needs b. an updated system inventory/asset list based on the organization’s systems c. a risk assessment completed after updating the current SSP to reflect the new controls within the network and information systems 4. There is a lack of multifactor authentication (MFA) and a need to identify and authenticate organizational users requiring access to the network and information systems. We appreciate the time FMC employees spent with us to help us compile this report. If you have any questions, please feel free to consult Pruhart Security Consulting at any time. Regards, Sophia Martin, Head Consultant, Pruhart Security Consulting ) PAGE 4 DFN1 Task 1: Governance, Risk, and Compliance Security Assessment Report ) PAGE 5 Table of Contents 1 Overview ....................................................................................................................................................................................... 5 1.1 Applicable Standards and Guidance ........................................................................................................................ 5 1.2 Purpose ............................................................................................................................................................................... 5 2 System Overview ....................................................................................................................................................................... 6 2.1 System Name ................................................................................................................................................................... 6 3 Assessment Methodology ........................................................................................................................................................ 7 3.1 Overall Security Findings ............................................................................................................................................. 8 3.2 Overall Findings Across All Connected Systems ................................................................................................. 8 3.3 Security and Privacy Control Families/Control Enhancements ...................................................................... 9 DFN1 Task 1: Governance, Risk, and Compliance Security Assessment Report 1 Overview This document represents the security assessment report (SAR) for FMC as requested as part of the security assessment and posture for FMC and related entities. This SAR contains the summary results of the comprehensive security test and evaluation of FMC. This assessment report, and the results documented herein, supports program goals, efforts, and activities necessary to achieve compliance with organizational security requirements. Title III, Section 3544, of the E-Government Act of 2002, dated December 17, 2002, requires agencies to conduct periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency. Appendix III of Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, requires federal agencies to do the following: • Review the security controls in each system when significant modifications are made to the system, but at least every three years. §3(a)(3) • Protect government information commensurate with the risk and magnitude of harm that could result from the loss, misuse, or unauthorized access to or modification of such information. §8(a)(1)(g); §8(a)(9)(a) • Demonstrate specific methods used to ensure that risks and the potential for loss are understood and continually assessed, that steps are taken to maintain risk at an acceptable level, and that procedures are in place to ensure that controls are implemented effectively and remain effective over time. §8(b)(3)(b)(iv) • Ensure that a management official authorizes in writing the use of the application by confirming that its security plan as implemented adequately secures the application. Results of the most recent review or audit of controls shall be a factor in management authorizations. The application must be authorized prior to operating and reauthorized at least every three years thereafter. Management authorization implies accepting the risk of each system used by the application. §(3)(b)(4)