Assessment Objective
Determine if:
- CP-09(07) dual authorization for the deletion or destruction of [Assignment: backup information] is enforced.
Assessment Methods
Examine
- Contingency planning policy
- procedures addressing system backup
- contingency plan
- system design documentation
- system configuration settings and associated documentation
- system generated list of dual authorization credentials or rules
- logs or records of deletion or destruction of backup information
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system backup responsibilities
- organizational personnel with information security responsibilities
Test
- Mechanisms supporting and/or implementing dual authorization
- mechanisms supporting and/or implementing the deletion/destruction of backup information
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | CP-09(07) Dual Authorization for Deletion or Destruction |