3.3.2—Audit and Accountability - Basic
Basic Requirement
>Control Description
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.
>Discussion
This requirement ensures that the contents of the audit record include the information needed to link the audit event to the actions of an individual to the extent feasible. Organizations consider logging for traceability including results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, communications at system boundaries, configuration settings, physical access, nonlocal maintenance, use of maintenance tools, temperature and humidity, equipment delivery and removal, system component inventory, use of mobile code, and use of Voice over Internet Protocol (VoIP).
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern role-based security training?
- •How do you identify roles requiring specialized security training?
- •What procedures ensure training matches role responsibilities?
- •Who approves security training requirements for different roles?
- •How often is role-based training updated and refreshed?
Technical Implementation:
- •How do you assign and track role-based security training?
- •What learning management system manages role-specific curricula?
- •What technical controls link training requirements to role assignments?
- •How do you deliver specialized training for privileged users?
- •What mechanisms enforce role-based training before access grant?
Evidence & Documentation:
- •Can you provide role-based training matrices and materials?
- •What records show specialized training for different role types?
- •Can you demonstrate admins receive admin-specific security training?
- •What evidence shows training is tailored to role responsibilities?
- •What compliance reports track role-based training completion?
Ask AI
Configure your API key to use AI features.