CP-9(7)

Requirement

Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information].

Discussion

Dual authorization ensures that deletion or destruction of backup information cannot occur unless two qualified individuals carry out the task. Individuals deleting or destroying backup information possess the skills or expertise to determine if the proposed deletion or destruction of information reflects organizational policies and procedures. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Contingency planning policy; procedures addressing system backup; contingency plan; system design documentation; system configuration settings and associated documentation; system generated list of dual authorization credentials or rules; logs or records of deletion or destruction of backup information; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system backup responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing dual authorization; mechanisms supporting and/or implementing the deletion/destruction of backup information].

ID	Assessment Objectives
CP-09(07)	dual authorization for the deletion or destruction of <CP-09(07)_ODP backup information> is enforced.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!