IAC-26
Permitted Actions Without Identification or Authorization
Description
Mechanisms exist to identify and document the supporting rationale for specific user actions that can be performed on a system without identification or authentication.
Control Question
Does the organization identify and document the supporting rationale for specific user actions that can be performed on a system without identification or authentication?
Control Metadata
Domain:
Identification & Authentication
Validation Cadence:
Annual