id: "CM-05(04)" title: "Dual Authorization" family: "CM" family_name: "Configuration Management" sort_id: "cm-05.04" priority: "P1" implementation_level: "system" parent: "CM-05" enhancement: True
Statement
Enforce dual authorization for implementing changes to {{ insert: param, cm-5.4_prm_1 }}.
Guidance
Organizations employ dual authorization to help ensure that any changes to selected system components and information cannot occur unless two qualified individuals approve and implement such changes. The two individuals possess the skills and expertise to determine if the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures.
Assessment Objective: dual authorization for implementing changes to {{ insert: param, cm-05.04_odp.01 }} is enforced;
Assessment Objective: dual authorization for implementing changes to {{ insert: param, cm-05.04_odp.02 }} is enforced.
Configuration management policy
procedures addressing access restrictions for changes to the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
change control records
system audit records
system component inventory
system information types information
system security plan
other relevant documents or records
Organizational personnel with dual authorization enforcement responsibilities for implementing system changes
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for managing access restrictions to change
mechanisms implementing dual authorization enforcement