AU-9(5)

Requirement

Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].

Discussion

Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; access authorizations; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators].

Test

[SELECT FROM: Mechanisms implementing the enforcement of dual authorization].

ID	Assessment Objectives
AU-09(05)	dual authorization is enforced for the <AU-09(05)_ODP[01] SELECTED PARAMETER VALUES> of <AU-09(05)_ODP[02] audit information>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!