SA-08(22) Accountability and Traceability

Assessment Objective

Determine if:

SA-08(22)[01] [Assignment: systems or system components] implement the security design principle of accountability;
SA-08(22)[02] [Assignment: systems or system components] implement the security design principle of traceability.

System and services acquisition policy
audit and accountability policy
access control policy
procedures addressing least privilege
procedures addressing auditable events
identification and authentication policy
procedures addressing user identification and authentication
procedures addressing the security design principle of accountability and traceability used in the specification, design, development, implementation, and modification of the system
system design documentation
system audit records
system auditable events
system configuration settings and associated documentation
security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
other relevant documents or records

Organizational personnel with the responsibility for determining system security and privacy requirements
organizational personnel with audit and accountability responsibilities
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
organizational personnel with information security responsibilities

Organizational processes for applying the security design principle of accountability and traceability in system specification, design, development, implementation, and modification
mechanisms supporting the application of the security design principle of accountability and traceability in system specification, design, development, implementation, and modification
mechanisms implementing information system auditing
mechanisms implementing least privilege functions

Sagslinks
Linktype	Sag
blocks	SA-08(22) Accountability and Traceability