03.03.03E Dual Authorization for Audit Information and Actions

Statement

Enforce dual authorization for {{ insert: param, A.03.03.03E.ODP.01 }} of {{ insert: param, A.03.03.03E.ODP.02 }}.

Guidance

Dual authorization is also known as two-person control since it requires the approval of two authorized individuals to reduce the risk related to insider threat when executing audit functions. Dual authorization reduces risks related to insider threats, including adversaries who have obtained credentials. Organizations may choose different selection options for different types of audit information. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.03.08. It is also related to requirement 03.01.01E.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization is enforced for the {{ insert: param, A.03.03.03E.ODP.01 }} of {{ insert: param, A.03.03.03E.ODP.02 }}.

Assessment method

• Audit and accountability policy system security plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation access authorizations system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms implementing the enforcement of dual authorization

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final