11.11 - Revision history

Neil thibodaux: /* Arizona Senate Allegations */

2026-08-28T03:57:08Z

Arizona Senate Allegations

← Older revision		Revision as of 20:57, 27 August 2026
Line 40:		Line 40:
	*** The status of this allegation was left as indeterminate by the AZ AG's inspector.		*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
	** [[The Anomalies#MC EMS 2020 - Operating System Logs Not Preserved\|MC EMS 2020 - Operating System Logs Not Preserved]]		** [[The Anomalies#MC EMS 2020 - Operating System Logs Not Preserved\|MC EMS 2020 - Operating System Logs Not Preserved]]
	*** The status of this allegation was left as indeterminate by the AZ AG's inspector.		*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
	** [[The Anomalies#MC EMS 2020 - Internet Connections to the EMS\|MC EMS 2020 - Internet Connections to the EMS]]

Neil thibodaux: /* Election Anomalies */

2026-08-28T03:56:19Z

Election Anomalies

← Older revision		Revision as of 20:56, 27 August 2026
Line 16:		Line 16:

	=== Election Anomalies ===		=== Election Anomalies ===
	~~No examples~~ are ~~available~~ to ~~illustrate governance gaps~~ for this ~~attribute~~.
			===== Arizona Senate Allegations =====
			Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the [https://www.azag.gov/sites/default/files/2025-06/2020_General_Election_Investigation_Summary.pdf Arizona Attorney General's Office 2020 General Election Investigation]. This Green Book attribute applies given the Arizona Senate's concern that the 2020 election results may have been fraudulently reported,

			* [[The Anomalies#Maricopa Election Management Server (2020)\|Maricopa Election Management Server (2020)]]
			** [[The Anomalies#MC EMS 2020 - Election Management System Database Purged\|MC EMS 2020 - Election Management System Database Purged]]
			*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Election Files Deleted\|MC EMS 2020 - Election Files Deleted]]
			*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Corrupt Ballot Images\|MC EMS 2020 - Corrupt Ballot Images]]
			** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Missing Ballot Images\|MC EMS 2020 - Missing Ballot Images]]
			** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Failure to Follow Basic Cyber Security Practices\|MC EMS 2020 - Failure to Follow Basic Cyber Security Practices]]
			*** MC leadership claimed two-people are required to ensure access to the EMS server as a security measure to prevent fraudulent access. This appears as a deterrent. However, this risk prevent measure is less than is required to pick up early ballots from a drop box. Two-people, each from a different political party are required to pick up early ballots from a drop box as reported in the [[Dropbox Collection (2020)\|Maricopa Dropbox Collection (2020)]] allegation. More personnel security is applied to drop boxes than the EMS server and a single drop box collection is just a tiny fraction of the over 1.9 million voting results residing in the EMS server.
			*** The AZ AG's inspector did not mention any entry and exit logs, to record specific individulas that had access to the EMS server.
			*** MC leadership also claimed that 24-hour surveillance cameras ensured restricted access. However, the AZ AG inspector was apparently not granted access to the digital recordings of the surveillance camera(s). The digital recordings are probably overwritten periodically to save memory. Hence, the presents of the 24-hour cameras may appear as a deterrent, but would be of no value for investigative purposes after the suspected timeframe is overwritten with new data.
			** [[The Anomalies#MC EMS 2020 - Subpoenaed Equipment Not Yet Provided\|MC EMS 2020 - Subpoenaed Equipment Not Yet Provided]]
			*** This was resolved through litigation. MC leadership was not willingly sharing data with the Arizona Senate. The lack of transparency suggests something to hide to an observant Public
			** [[The Anomalies#MC EMS 2020 - Anonymous Logins\|MC EMS 2020 - Anonymous Logins]]
			*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Dual Boot System Discovered\|MC EMS 2020 - Dual Boot System Discovered]]
			*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Operating System Logs Not Preserved\|MC EMS 2020 - Operating System Logs Not Preserved]]
			*** The status of this allegation was left as indeterminate by the AZ AG's inspector.
			** [[The Anomalies#MC EMS 2020 - Internet Connections to the EMS\|MC EMS 2020 - Internet Connections to the EMS]]

Neil thibodaux at 17:02, 22 August 2026

2026-08-22T17:02:50Z

← Older revision		Revision as of 10:02, 22 August 2026
Line 7:		Line 7:
	'''>>>Navigational Buttons<<<'''		'''>>>Navigational Buttons<<<'''
	* '''[[Index of Attributes]]'''		* '''[[Index of Attributes]]'''
	* '''Previous Attribute - ?'''		* '''Previous Attribute - [[11.10]]'''
	* '''Next Attribute - ?'''		* '''Next Attribute - [[11.12]]'''
	__FORCETOC__		__FORCETOC__

	=== '''No ~~Examples'''~~ ===
			=== Jamie's Story ===
			No examples are available to illustrate governance gaps for this attribute.

			=== Election Anomalies ===
			No examples are available to illustrate governance gaps for this attribute.

Neil thibodaux at 01:54, 16 August 2026

2026-08-16T01:54:42Z

← Older revision		Revision as of 18:54, 15 August 2026
Line 4:		Line 4:

	'''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access control activities require users to authenticate themselves and restrict them to the applications or functions commensurate with their assigned responsibilities, supporting an appropriate segregation of duties. Management may grant different permissions to employees and end users, including the rights to create, read, edit, or delete a file; execute a program; and retrieve or update information in a database. Management designs other control activities to promptly update access rights when employees change job functions or leave the entity. Physical access control activities involve restricting physical access to information and information technology, including the physical infrastructure, and protecting it from intentional or unintentional loss or impairment.		'''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access control activities require users to authenticate themselves and restrict them to the applications or functions commensurate with their assigned responsibilities, supporting an appropriate segregation of duties. Management may grant different permissions to employees and end users, including the rights to create, read, edit, or delete a file; execute a program; and retrieve or update information in a database. Management designs other control activities to promptly update access rights when employees change job functions or leave the entity. Physical access control activities involve restricting physical access to information and information technology, including the physical infrastructure, and protecting it from intentional or unintentional loss or impairment.

			'''>>>Navigational Buttons<<<'''
			* '''[[Index of Attributes]]'''
			* '''Previous Attribute - ?'''
			* '''Next Attribute - ?'''
			__FORCETOC__

			=== '''No Examples''' ===

Neil thibodaux: Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access c..."

2026-08-16T01:44:02Z

Created page with "'''Control Activities''' '''Principle 11 - Design General Control Activities over Information Technology''' '''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access c..."

New page

'''Control Activities'''

'''Principle 11 - Design General Control Activities over Information Technology'''

'''Attribute 11.11''' - Logical and physical access control activities include restricting access or detecting inappropriate access to information and information technology. They protect information technology resources against unauthorized access, use, disclosure, disruption, modification, or destruction, whether from malicious intent or error. Logical access control activities require users to authenticate themselves and restrict them to the applications or functions commensurate with their assigned responsibilities, supporting an appropriate segregation of duties. Management may grant different permissions to employees and end users, including the rights to create, read, edit, or delete a file; execute a program; and retrieve or update information in a database. Management designs other control activities to promptly update access rights when employees change job functions or leave the entity. Physical access control activities involve restricting physical access to information and information technology, including the physical infrastructure, and protecting it from intentional or unintentional loss or impairment.