AC-3(2)

Requirement

Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].

Discussion

Dual authorization, also known as two-person control, reduces risk related to insider threats. Dual authorization mechanisms require the approval of two authorized individuals to execute. To reduce the risk of collusion, organizations consider rotating dual authorization duties. Organizations consider the risk associated with implementing dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorization; system design documentation; system configuration settings and associated documentation; list of privileged commands requiring dual authorization; list of actions requiring dual authorization; list of approved authorizations (user privileges); system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with access enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Dual authorization mechanisms implementing access control policy].

ID	Assessment Objectives
AC-03(02)	dual authorization is enforced for <AC-03(02)_ODP privileged commands and/or other actions>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!