SAR Content Sample Clauses

SAR Content. The SAR content includes the following information: • System Overview; • Executive Summary Report; • Detailed Findings Report; • Scan Results – Infrastructure Scan – Database Scan – Web Applications Scan; • Penetration Test Report; and • Penetration Test and Scan Results Summary. The SAR presents the results of all testing performed, including technical testing, scans, configuration assessment, documentation review, personnel interviews, and penetration testing. Results from multiple testing sources may be consolidated in one finding, if findings are closely related. The findings of the assessment should be annotated in detail with the remediation recommendations for the weaknesses and deficiencies found in the system security and privacy controls implementation. To reduce the risks posed to this important healthcare service and to protect the sensitive information of the citizens who use this service, the assessment team must assign business and system risk levels to each specific finding. The assignment of these risk levels should follow the methodology outlined in NIST SP 800-30 Rev. 1, Appendices G, H, and I6 when assigning risk levels. The SAR structure should allow the independent third-party assessor to communicate the security and privacy assessment results to several targeted audience levels, ranging from executives to technical staff. A sample SAR used by the Federal Risk and Authorization Management Program (FedRAMP) can be modeled after7.