AU-10(4) Validate Binding of Information Reviewer Identity
Control enhancement of AU-10 Non-repudiation
Control
Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: security domains] ; and
Perform [Assignment: actions] in the event of a validation error.
Discussion
Validating the binding of the information reviewer identity to the information at transfer or release points prevents the unauthorized modification of information between review and the transfer or release. The validation of bindings can be achieved by using cryptographic checksums. Organizations determine if validations are in response to user requests or generated automatically.
Related controls
Need AU-10(4) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.