Navigate

CCI-002747

CCI-002747 Definition

Defines the individuals who have the authorization to use the manual override capability for input validation.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the use of the manual override capability is restricted to only [SI-10(01)_ODP; authorized individuals who can use the manual override capability are defined].

Validation Procedures

Examine: [SELECT FROM: System and information integrity policy; system and information integrity procedures; access control policy and procedures; separation of duties policy and procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer]. Test: [SELECT FROM: Organizational processes for the use of a manual override capability; mechanisms supporting and/or implementing a manual override capability for input validation; mechanisms supporting and/or implementing auditing of the use of a manual override capability].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002747.

Control	Description
SI-10(1)	(a): Provide a manual override capability for input validation of the following information inputs: [information inputs to the system requiring validity checks are defined;]; (b): Restrict the use of the manual override capability to only [authorized individuals who can use the manual override capability are defined;] ; and (c): Audit the use of the manual override capability.