CM-5(4): Dual Authorization

Control Family:

Configuration Management

Parent Control:

CM-5: Access Restrictions For Change

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.IP-1

Threats Addressed:

Tampering
Elevation of Privilege

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
CM-5(4): Dual Authorization

Control Statement

The organization enforces dual authorization for implementing changes to [Assignment: organization-defined information system components and system-level information].

Supplemental Guidance

Organizations employ dual authorization to ensure that any changes to selected information system components and information cannot occur unless two qualified individuals implement such changes. The two individuals possess sufficient skills/expertise to determine if the proposed changes are correct implementations of approved changes. Dual authorization may also be known as two-person control.