AU-10(2)

Requirement
1. Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency]; and
2. Perform [Assignment: organization-defined actions] in the event of a validation error.

Discussion

Validating the binding of the information producer identity to the information prevents the modification of information between production and review. The validation of bindings can be achieved by, for example, using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiation; system design documentation; system configuration settings and associated documentation; validation records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

ID	Assessment Objectives
AU-10(02)(a)	the binding of the information producer identity to the information is validated at <AU-10(02)_ODP[01] frequency>;
AU-10(02)(b)	<AU-10(02)_ODP[02] actions> in the event of a validation error are performed.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!