Assessment Objective
Determine if:
- authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.
- an identifier that identifies an individual, group, role, service, or device is selected.
- an identifier that identifies an individual, group, role, service, or device is assigned.
- the reuse of identifiers for [Assignment: time period] is prevented.
- individual identifiers are managed by uniquely identifying each individual as [Assignment: characteristic].
Assessment Methods
Examine
- identification and authentication policy and procedures
- procedures for identifier management
- procedures for account management
- system design documentation
- list of system accounts
- list of characteristics identifying individual status
- system configuration settings
- list of identifiers generated from physical access control devices
- system security plan
- other relevant documents or records
Interview
- personnel with identifier management responsibilities
- personnel with information security responsibilities
- system developers
- system administrators
Test
- mechanisms for supporting or implementing identifier management
Povezani zadaci
| Vrsta poveznice | Zadatak |
|---|---|
| blocks | 03.05.05 Identifier Management |