+AU-09(05) Dual Authorization
|
AU-09(05) Dual Authorization
Control
Enforce dual authorization for [Selection(one-or-more): movement; deletion] of [Assignement: audit information].
Discussion
Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.
Assessment Objective
dual authorization is enforced for the [Selection(one-or-more): movement; deletion] of [Assignement: audit information].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
access authorizations
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|