+CM-05(05) Privilege Limitation for Production and Operation
|
CM-05(05) Privilege Limitation for Production and Operation
Control
- Limit privileges to change system components and system-related information within a production or operational environment; and
- Review and reevaluate privileges [Assignement: organization-defined frequency].
Discussion
In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.
Assessment Objective
- privileges to change system components within a production or operational environment are limited;
- privileges to change system-related information within a production or operational environment are limited;
- privileges are reviewed [Assignement: frequency];
- privileges are reevaluated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
procedures addressing access restrictions for changes to the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
user privilege reviews
user privilege recertifications
system component inventory
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with information security responsibilities
system/network administrators
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|