+CP-09(07) Dual Authorization for Deletion or Destruction

CP-09(07) Dual Authorization for Deletion or Destruction

Control

Enforce dual authorization for the deletion or destruction of [Assignement: backup information].

Discussion

Dual authorization ensures that deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals deleting or destroying backup information possess the skills or expertise to determine if the proposed deletion or destruction of information reflects organizational policies and procedures. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals.

Assessment Objective

dual authorization for the deletion or destruction of [Assignement: backup information] is enforced.

Assessment Method

Examine

Contingency planning policy procedures addressing system backup contingency plan system design documentation system configuration settings and associated documentation system generated list of dual authorization credentials or rules logs or records of deletion or destruction of backup information system security plan other relevant documents or records

Interview

Organizational personnel with system backup responsibilities organizational personnel with information security responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by CP-09(07) Dual Authorization for Deletion or Destruction – Assessment Procedure
is blocked by Dual Authorization For Sensitive / Regulated Backup Media Destruction