Assessment Objective
Determine if:
- system users are uniquely identified.
- system users are authenticated.
- processes acting on behalf of users are associated with uniquely identified and authenticated system users.
- users are reauthenticated when [Assignment: circumstances or situations] .
Assessment Methods
Examine
- identification and authentication policy and procedures
- list of circumstances or situations requiring re-authentication
- system design documentation
- system configuration settings
- system audit records
- list of system accounts
- system security plan
- other relevant documents or records
Interview
- personnel with identification and authentication responsibilities
- personnel with system operations responsibilities
- personnel with account management responsibilities
- system developers
- personnel with information security responsibilities
- system administrators
Test
- processes for uniquely identifying and authenticating users
- mechanisms for supporting or implementing identification and authentication capabilities
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | 03.05.01 User Identification and Authentication |