+AC-04(09) Human Reviews

AC-04(09) Human Reviews

Control

Enforce the use of human reviews for [Assignement: information flows] under the following conditions: [Assignement: conditions].

Discussion

Organizations define security or privacy policy filters for all situations where automated flow control decisions are possible. When a fully automated flow control decision is not possible, then a human review may be employed in lieu of or as a complement to automated security or privacy policy filtering. Human reviews may also be employed as deemed necessary by organizations.

Assessment Objective

human reviews are used for [Assignement: information flows] under [Assignement: conditions].

Assessment Method

Examine

Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation records of human reviews regarding information flows list of information flows requiring the use of human reviews list of conditions requiring human reviews for information flows system audit records system security plan privacy plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security and privacy responsibilities organizational personnel with information flow enforcement responsibilities system developers

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by AC-04(09) Human Reviews – Assessment Procedure
is blocked by Human Reviews