+RA-05(05) [M] Privileged Access
|
RA-05(05) [M] Privileged Access
Control
Implement privileged access authorization to [Assignement: system components] for [Assignement: vulnerability scanning activities].
Discussion
In certain situations, the nature of the vulnerability scanning may be more intrusive, or the system component that is the subject of the scanning may contain classified or controlled unclassified information, such as personally identifiable information. Privileged access authorization to selected system components facilitates more thorough vulnerability scanning and protects the sensitive nature of such scanning.
Assessment Objective
privileged access authorization is implemented to [Assignement: system components] for [Assignement: vulnerability scanning activities].
Assessment Method
Examine
Risk assessment policy
procedures addressing vulnerability scanning
system design documentation
system configuration settings and associated documentation
list of system components for vulnerability scanning
personnel access authorization list
authorization credentials
access authorization records
system security plan
other relevant documents or records
Interview
Organizational personnel with vulnerability scanning responsibilities
system/network administrators
organizational personnel responsible for access control to the system
organizational personnel responsible for configuration management of the system
system developers
organizational personnel with security responsibilities
1. Przegląd
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
Powiązane zgłoszenia
|