+AU-09(06) Read-only Access

AU-09(06) Read-only Access

Control

Authorize read-only access to audit information to [Assignement: subset of privileged users or roles].

Discussion

Restricting privileged user or role authorizations to read-only helps to limit the potential damage to organizations that could be initiated by such users or roles, such as deleting audit records to cover up malicious activity.

Assessment Objective

read-only access to audit information is authorized to [Assignement: subset of privileged users or roles].

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system-generated list of privileged users with read-only access to audit information access authorizations access control list system audit records other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by AU-09(06) Read-only Access – Assessment Procedure