SFS 1 / SF 4

Back to SFS 1

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all privileged administrative actions recorded in tamper-evident audit logs to enable accountability throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Complete auditable records showing timestamped privileged actions with unique user identification

Assessment criterion and evidence

Actor: Authorized administrators and system maintainers. Scope: All privileged account usage and master key operations across the organization's systems. Evidence period: The most recent 12-month review period. Required evidence: Tamper-evident audit logs; Unique administrator identification; Complete action records. Negative criterion: Unidentified or unlogged privileged activities, or logs that could be altered without detection. Missing evidence: Pending verification if audit logs are unavailable or incomplete for the review period

View the JSON record (opens in a new tab).

Assessment result: unset.