id: "AC-03(02)" title: "Dual Authorization" family: "AC" family_name: "Access Control" sort_id: "ac-03.02" priority: "P1" implementation_level: "system" parent: "AC-03" enhancement: True
Statement
Enforce dual authorization for {{ insert: param, ac-03.02_odp }}.
Guidance
Dual authorization, also known as two-person control, reduces risk related to insider threats. Dual authorization mechanisms require the approval of two authorized individuals to execute. To reduce the risk of collusion, organizations consider rotating dual authorization duties. Organizations consider the risk associated with implementing dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.
Assessment Objective
dual authorization is enforced for {{ insert: param, ac-03.02_odp }}.
Access control policy
procedures addressing access enforcement and dual authorization
system design documentation
system configuration settings and associated documentation
list of privileged commands requiring dual authorization
list of actions requiring dual authorization
list of approved authorizations (user privileges)
system security plan
other relevant documents or records
Organizational personnel with access enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers
Dual authorization mechanisms implementing access control policy