Assessment Objective
Determine if:
- dual authorization for implementing changes to [Assignment: system components] is enforced.
- dual authorization for implementing changes to [Assignment: system-level information] is enforced.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing access restrictions for changes to the system
- configuration management plan
- system design documentation
- system architecture and configuration documentation
- system configuration settings and associated documentation
- change control records
- system audit records
- system component inventory
- system information types
- system security plan
- other relevant documents or records
Interview
- Personnel with dual authorization enforcement responsibilities for implementing system changes
- personnel with information security responsibilities
- system/network administrators
Test
- Processes for managing access restrictions to change
- mechanisms implementing dual authorization enforcement
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | 03.04.05E Dual Authorization for System Changes |