+CM-05(04) Dual Authorization
|
CM-05(04) Dual Authorization
Control
Enforce dual authorization for implementing changes to [Assignement: organization-defined system components and system-level information].
Discussion
Organizations employ dual authorization to help ensure that any changes to selected system components and information cannot occur unless two qualified individuals approve and implement such changes. The two individuals possess the skills and expertise to determine if the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures.
Assessment Objective
- dual authorization for implementing changes to [Assignement: system components] is enforced;
- dual authorization for implementing changes to [Assignement: system-level information] is enforced.
Assessment Method
Examine
Configuration management policy
procedures addressing access restrictions for changes to the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
change control records
system audit records
system component inventory
system information types information
system security plan
other relevant documents or records
Interview
Organizational personnel with dual authorization enforcement responsibilities for implementing system changes
organizational personnel with information security responsibilities
system/network administrators
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|