Assessment Objective
Determine if:
- duties of individuals requiring separation are identified.
- system access authorizations to support separation of duties are defined.
Assessment Methods
Examine
- access control policy and procedures
- procedures for the separation of duties and the division of responsibilities
- system configuration settings
- system audit records
- system access authorizations
- list of divisions of responsibility and separation of duties
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for defining the separation of duties and the division of responsibilities
- personnel with information security responsibilities
- system administrators
Test
- mechanisms for implementing the separation of duties policy
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | 03.01.04 Separation of Duties |