Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

au-9(5)

protection of audit information | dual authorization

assessment objective:

Determine if the organization:

au-9(5)[1]

defines audit information for which dual authorization is to be enforced;

au-9(5)[2]

defines one or more of the following types of operations on audit information for which dual authorization is to be enforced:

au-9(5)[2][a]

movement; and/or

au-9(5)[2][b]

deletion; and

au-9(5)[3]

enforces dual authorization for the movement and/or deletion of organization-defined audit information.

potential assessment methods and objects:

Examine: [select from: Audit and accountability policy; access control policy and procedures; procedures addressing protection of audit information; information system design documentation; information system configuration settings and associated documentation, access authorizations; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test: [SELECT FROM: Automated mechanisms implementing enforcement of dual authorization].