---

id: "AU-09(05)" title: "Dual Authorization" family: "AU" family_name: "Audit and Accountability" sort_id: "au-09.05" priority: "P2" implementation_level: "system" parent: "AU-09" enhancement: True

---

Statement

Enforce dual authorization for {{ insert: param, au-09.05_odp.01 }} of {{ insert: param, au-09.05_odp.02 }}.

Guidance

Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.

Assessment Objective

dual authorization is enforced for the {{ insert: param, au-09.05_odp.01 }} of {{ insert: param, au-09.05_odp.02 }}.

Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system configuration settings and associated documentation

access authorizations

system audit records

other relevant documents or records

Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

Mechanisms implementing the enforcement of dual authorization