Navigate

AC-3(2)

AC-3(2): Dual Authorization

The information system enforces dual authorization for [organization-defined privileged commands and/or other organization-defined actions].

Supplemental

Dual authorization mechanisms require the approval of two authorized individuals in order to execute. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety. Dual authorization may also be known as two-person control.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-3(2).

Control	Description
CP-9	The organization: a: Conducts backups of user-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives]; b: Conducts backups of system-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives]; c: Conducts backups of information system documentation including security-related documentation [organization-defined frequency consistent with recovery time and recovery point objectives]; and d: Protects the confidentiality, integrity, and availability of backup information at storage locations.
MP-6	The organization: a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Control

Description

CP-9

The organization:

a: Conducts backups of user-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives];

b: Conducts backups of system-level information contained in the information system [organization-defined frequency consistent with recovery time and recovery point objectives];

c: Conducts backups of information system documentation including security-related documentation [organization-defined frequency consistent with recovery time and recovery point objectives]; and

d: Protects the confidentiality, integrity, and availability of backup information at storage locations.

MP-6

The organization:

a: Sanitizes [organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and

b: Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Enhancements

The controls below (if any) add on to the requirements of AC-3(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-3(2).

CCI	Definition
CCI-000021	Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions.
CCI-001408	Defines privileged commands for which dual authorization is to be enforced.
CCI-002152	Defines other actions necessary for which dual authorization is to be enforced.