SFS 9 / SF C

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed verification of authentication and authorization controls across all defined user roles during security audits for in-scope applications throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented audit reports explicitly verify both authentication controls and authorization logic across all user roles

Assessment criterion and evidence

Actor: Organization conducting or commissioning security audits. Scope: All in-scope applications' authentication mechanisms and role-based access controls. Evidence period: Current review period. Required evidence: Security audit reports showing methodology for testing authentication controls; Evidence of authorization testing across multiple user role categories; Documentation of test results for regular/non-privileged user roles. Negative criterion: Audit documentation lacks verification of authorization controls for one or more user roles, or only covers privileged accounts. Missing evidence: No audit documentation provided for verification of user role controls

View the JSON record (opens in a new tab).

Assessment result: unset.