+AC-03(02) Dual Authorization
|
AC-03(02) Dual Authorization
Control
Enforce dual authorization for [Assignement: privileged commands and/or other actions].
Discussion
Dual authorization, also known as two-person control, reduces risk related to insider threats. Dual authorization mechanisms require the approval of two authorized individuals to execute. To reduce the risk of collusion, organizations consider rotating dual authorization duties. Organizations consider the risk associated with implementing dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.
Assessment Objective
dual authorization is enforced for [Assignement: privileged commands and/or other actions].
Assessment Method
Examine
Access control policy
procedures addressing access enforcement and dual authorization
system design documentation
system configuration settings and associated documentation
list of privileged commands requiring dual authorization
list of actions requiring dual authorization
list of approved authorizations (user privileges)
system security plan
other relevant documents or records
Interview
Organizational personnel with access enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|