{
    "document_id": 15477,
    "page": 19,
    "width_pt": 612,
    "height_pt": 792,
    "rotation": 0,
    "pipeline_version": "paddleocr-vl-1.6+paul-48",
    "engine": "paddleocr_vl",
    "source_run_id": 15590,
    "item_count": 14,
    "counts_by_type": {
        "footer": 1,
        "header": 1,
        "heading": 1,
        "link": 1,
        "list_item": 5,
        "text": 5
    },
    "build_ms": 1,
    "items": [
        {
            "id": "p19.1",
            "order": 1,
            "type": "header",
            "bbox": {
                "l": 70.08,
                "t": 707.76,
                "r": 485.52,
                "b": 693.84
            },
            "text": "Finding 20: KSU Did Not Implement Adequate Password and Identification Controls",
            "attrs": {
                "block_label": "header"
            },
            "level": 2
        },
        {
            "id": "p19.2",
            "order": 2,
            "type": "heading",
            "bbox": {
                "l": 70.08,
                "t": 683.04,
                "r": 168.48,
                "b": 668.64
            },
            "text": "Recommendations:",
            "level": 3
        },
        {
            "id": "p19.3",
            "order": 3,
            "type": "list_item",
            "bbox": {
                "l": 87.12,
                "t": 657.505,
                "r": 541.44,
                "b": 629.76
            },
            "text": "KSU configure their Network and Banner to require passwords to be changed prior to first use."
        },
        {
            "id": "p19.4",
            "order": 4,
            "type": "text",
            "bbox": {
                "l": 105.84,
                "t": 619.68,
                "r": 399.6,
                "b": 605.04
            },
            "text": "Response: KSU has implemented this recommendation."
        },
        {
            "id": "p19.5",
            "order": 5,
            "type": "list_item",
            "bbox": {
                "l": 87.12,
                "t": 593.975,
                "r": 541.92,
                "b": 565.92
            },
            "text": "The Network, Banner, and ADP require passwords to be changed at least every 60 days for all privileged accounts and every 90 days for all non-privileged accounts.",
            "marker": "-"
        },
        {
            "id": "p19.6",
            "order": 6,
            "type": "text",
            "bbox": {
                "l": 106.08,
                "t": 554.88,
                "r": 159.6,
                "b": 541.68
            },
            "text": "Response:\nKSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards, employing multi-factor authentication and complex password requirements. Following the guidelines of NIST Special Publication 800-63B, there is no longer a need for passwords to automatically expire. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable."
        },
        {
            "id": "p19.7",
            "order": 7,
            "type": "list_item",
            "bbox": {
                "l": 87.12,
                "t": 455.455,
                "r": 541.44,
                "b": 427.44
            },
            "text": "Banner passwords be required to contain both alphanumeric and special characters. The password history for both Banner and ADP should be increased to 24 passwords."
        },
        {
            "id": "p19.8",
            "order": 8,
            "type": "text",
            "bbox": {
                "l": 105.84,
                "t": 417.84,
                "r": 161.04,
                "b": 342.72
            },
            "text": "Response:\nKSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards. NIST Special Publication 800-63B does not make a recommendation regarding password history settings. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable."
        },
        {
            "id": "p19.9",
            "order": 9,
            "type": "list_item",
            "bbox": {
                "l": 87.6,
                "t": 329.655,
                "r": 542.4,
                "b": 289.2
            },
            "text": "KSU document the naming convention of Banner and ADP user IDs within a written policy. KSU should then regularly monitor user IDs established within Banner and ADP to ensure these adhere to the naming convention established within this policy."
        },
        {
            "id": "p19.10",
            "order": 10,
            "type": "text",
            "bbox": {
                "l": 106.32,
                "t": 278.64,
                "r": 160.08,
                "b": 230.64
            },
            "text": "Response:\nKSU has implemented this recommendation. Information Technology has drafted a Banner and ADP guideline which documents the naming convention and is currently reviewing user IDs to ensure these adhere to the established naming convention."
        },
        {
            "id": "p19.11",
            "order": 11,
            "type": "text",
            "bbox": {
                "l": 70.32,
                "t": 200.16,
                "r": 329.52,
                "b": 185.52
            },
            "text": "Sixty-Day Management Response can be found here.",
            "children": [
                {
                    "id": "p19.11.1",
                    "order": 12,
                    "type": "link",
                    "bbox": {
                        "l": 303.451,
                        "t": 200.426,
                        "r": 324.994,
                        "b": 186.499
                    },
                    "text": "here.",
                    "attrs": {
                        "action_type": "/Named"
                    }
                }
            ]
        },
        {
            "id": "p19.12",
            "order": 13,
            "type": "list_item",
            "bbox": {
                "l": 459.95,
                "t": 61.861999999999966,
                "r": 507.36,
                "b": 48.48
            },
            "text": "Page 16",
            "attrs": {
                "block_label": "number"
            }
        },
        {
            "id": "p19.13",
            "order": 14,
            "type": "footer",
            "bbox": {
                "l": 103.44,
                "t": 61.92,
                "r": 466.8,
                "b": 48.24
            },
            "text": "Kentucky State University – APA Special Examination 90-Day Response –",
            "attrs": {
                "block_label": "footer"
            }
        }
    ],
    "excluded_furniture": {
        "first": [],
        "last": []
    }
}