+CA-06(01) Joint Authorization — Intra-organization
|
CA-06(01) Joint Authorization — Intra-organization
Control
Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.
Discussion
Assigning multiple authorizing officials from the same organization to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It also implements the concepts of separation of duties and dual authorization as applied to the system authorization process. The intra-organization joint authorization process is most relevant for connected systems, shared systems, and systems with multiple information owners.
Assessment Objective
- a joint authorization process is employed for the system;
- the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.
Assessment Method
Examine
Assessment, authorization, and monitoring policy
procedures addressing authorization
system security plan
privacy plan
assessment report
plan of action and milestones
authorization statement
other relevant documents or records
Interview
Organizational personnel with authorization responsibilities
organizational personnel with information security and privacy responsibilities
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|