03.08.02E Dual Authorization for System Backup Deletion and Destruction

Statement

Enforce dual authorization for the deletion or destruction of {{ insert: param, A.03.08.02E.ODP.01 }}.

Guidance

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization ensures that the deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals who delete or destroy backup information possess the knowledge, skills, or expertise to determine whether the proposed deletion or destruction of such information reflects organizational policies and procedures. To reduce the risk of collusion, organizations often rotate dual authorization duties among various individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.08.09.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization for the deletion or destruction of {{ insert: param, A.03.08.02E.ODP.01 }} is enforced.

Assessment method

• Contingency planning policy procedures addressing system backup contingency plan system design documentation system configuration settings and associated documentation system-generated list of dual authorization credentials or rules logs or records of the deletion or destruction of backup information system security plan other relevant documents or records

Assessment method

• Personnel with system backup responsibilities personnel with information security responsibilities

Assessment method

• Mechanisms supporting and/or implementing dual authorization mechanisms supporting and/or implementing the deletion and/or destruction of backup information

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final