+AU-06(07) Permitted Actions
|
AU-06(07) Permitted Actions
Control
Specify the permitted actions for each [Selection(one-or-more): system process; role; user] associated with the review, analysis, and reporting of audit record information.
Discussion
Organizations specify permitted actions for system processes, roles, and users associated with the review, analysis, and reporting of audit records through system account management activities. Specifying permitted actions on audit record information is a way to enforce the principle of least privilege. Permitted actions are enforced by the system and include read, write, execute, append, and delete.
Assessment Objective
the permitted actions for each [Selection(one-or-more): system process; role; user] associated with the review, analysis, and reporting of audit record information are specified.
Assessment Method
Examine
Audit and accountability policy
procedures addressing process, role and/or user permitted actions from audit review, analysis, and reporting
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|