+03.01.01E Dual Authorization

03.01.01E Dual Authorization

Statement

Enforce dual authorization for {{ insert: param, A.03.01.01E.ODP.01 }}.

Guidance

Dual authorization is also known as two-person control. Dual authorization reduces risk related to insider threats, including adversaries who have obtained credentials. Dual authorization requires the approval of two authorized individuals to execute privileged commands and/or other organizational actions that may affect the protection of CUI. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations also consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.01.02.

Statement

  • (includes preempt) Ensure that the threat event does not have an impact.

    • Reduce likelihood of occurrence and/or reduce likelihood of impact.

    • The adversary’s efforts or resources cannot be applied or are wasted.

  • (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

    • Reduce likelihood of impact and reduce level of impact.

    • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization is enforced for {{ insert: param, A.03.01.01E.ODP.01 }}.

Assessment method

  • Access control policy procedures addressing access enforcement and dual authorization system design documentation system configuration settings and associated documentation list of actions requiring dual authorization list of privileged commands requiring dual authorization list of approved authorizations (user privileges) system security plan other relevant documents or records

Assessment method

  • Personnel with access enforcement responsibilities system/network administrators system developers personnel with information security responsibilities

Assessment method

  • Dual authorization mechanisms implementing access control policy

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

Krav

3. Relaterade regleringar

Regleringar

Länkade ärenden

Länkar
is blocked by 03.01.01E Dual Authorization – Assessment Procedure
is blocked by Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS)
is blocked by Dual Authorization for Privileged Commands