CCI-001340

Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released.

Implementation Guidance

Determine if reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.

Validation Procedures

Examine: [SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiation; system design documentation; system configuration settings and associated documentation; records of information reviews and releases; system audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information security and privacy responsibilities; system/network administrators; system developers]. Test: [SELECT FROM: Automated mechanisms implementing non-repudiation capability].

The controls below (if any) were marked by NIST as being related to CCI-001340.