NIST SP 800-53 (controls) 5.2.0
| Ref | Title | Text | |
|---|---|---|---|
| AU-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] audit and accountability policy that: (a) Address | |
| AU-02 | Event Logging | a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: event types]; b. Coordinate the event logging function with other organizational entities requiring audit-related informati | |
| AU-02(01) in AU-2 |
Compilation of Audit Records from Multiple Sources withdrawn | ||
| AU-02(02) in AU-2 |
Selection of Audit Events by Component withdrawn | ||
| AU-02(03) in AU-2 |
Reviews and Updates withdrawn | ||
| AU-02(04) in AU-2 |
Privileged Functions withdrawn | ||
| AU-03 | Content of Audit Records | Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any i | |
| AU-03(01) in AU-3 |
Additional Audit Information | Generate audit records containing the following additional information: [Assignment: additional information]. | |
| AU-03(02) in AU-3 |
Centralized Management of Planned Audit Record Content withdrawn | ||
| AU-03(03) in AU-3 |
Limit Personally Identifiable Information Elements | Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: elements]. | |
| AU-04 | Audit Log Storage Capacity | Allocate audit log storage capacity to accommodate [Assignment: audit log retention requirements]. | |
| AU-04(01) in AU-4 |
Transfer to Alternate Storage | Transfer audit logs [Assignment: frequency] to a different system, system component, or media other than the system or system component conducting the logging. | |
| AU-05 | Response to Audit Logging Process Failures | a. Alert [Assignment: personnel or roles] within [Assignment: time period] in the event of an audit logging process failure; and b. Take the following additional actions: [Assignment: additional actions]. | |
| AU-05(01) in AU-5 |
Storage Capacity Warning | Provide a warning to [Assignment: personnel, roles, and/or locations] within [Assignment: time period] when allocated audit log storage volume reaches [Assignment: percentage] of repository maximum audit log storage capacity. | |
| AU-05(02) in AU-5 |
Real-time Alerts | Provide an alert within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: audit logging failure events requiring real-time alerts]. | |
| AU-05(03) in AU-5 |
Configurable Traffic Volume Thresholds | Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection (one or more): reject; delay] network traffic above those thresholds. | |
| AU-05(04) in AU-5 |
Shutdown on Failure | Invoke a [Selection (one or more): full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: audit logging failures] , unless an alternate | |
| AU-05(05) in AU-5 |
Alternate Audit Logging Capability | Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: alternate audit logging functionality]. | |
| AU-06 | Audit Record Review, Analysis, and Reporting | a. Review and analyze system audit records [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [Assignment: pers | |
| AU-06(01) in AU-6 |
Automated Process Integration | Integrate audit record review, analysis, and reporting processes using [Assignment: automated mechanisms]. | |
| AU-06(02) in AU-6 |
Automated Security Alerts withdrawn | ||
| AU-06(03) in AU-6 |
Correlate Audit Record Repositories | Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. | |
| AU-06(04) in AU-6 |
Central Review and Analysis | Provide and implement the capability to centrally review and analyze audit records from multiple components within the system. | |
| AU-06(05) in AU-6 |
Integrated Analysis of Audit Records | Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; {{ insert: param, au-06.05_odp.02 }} ] to further enhance the ability to ide | |
| AU-06(06) in AU-6 |
Correlation with Physical Monitoring | Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity. | |
| AU-06(07) in AU-6 |
Permitted Actions | Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information. | |
| AU-06(08) in AU-6 |
Full Text Analysis of Privileged Commands | Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis. | |
| AU-06(09) in AU-6 |
Correlation with Information from Nontechnical Sources | Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness. | |
| AU-06(10) in AU-6 |
Audit Level Adjustment withdrawn | ||
| AU-07 | Audit Record Reduction and Report Generation | Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the | |
| AU-07(01) in AU-7 |
Automatic Processing | Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: fields within audit records]. | |
| AU-07(02) in AU-7 |
Automatic Sort and Search withdrawn | ||
| AU-08 | Time Stamps | a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time of | |
| AU-08(01) in AU-8 |
Synchronization with Authoritative Time Source withdrawn | ||
| AU-08(02) in AU-8 |
Secondary Authoritative Time Source withdrawn | ||
| AU-09 | Protection of Audit Information | a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information. | |
| AU-09(01) in AU-9 |
Hardware Write-once Media | Write audit trails to hardware-enforced, write-once media. | |
| AU-09(02) in AU-9 |
Store on Separate Physical Systems or Components | Store audit records [Assignment: frequency] in a repository that is part of a physically different system or system component than the system or component being audited. | |
| AU-09(03) in AU-9 |
Cryptographic Protection | Implement cryptographic mechanisms to protect the integrity of audit information and audit tools. | |
| AU-09(04) in AU-9 |
Access by Subset of Privileged Users | Authorize access to management of audit logging functionality to only [Assignment: subset of privileged users or roles]. | |
| AU-09(05) in AU-9 |
Dual Authorization | Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: audit information]. | |
| AU-09(06) in AU-9 |
Read-only Access | Authorize read-only access to audit information to [Assignment: subset of privileged users or roles]. | |
| AU-09(07) in AU-9 |
Store on Component with Different Operating System | Store audit information on a component running a different operating system than the system or component being audited. | |
| AU-10 | Non-repudiation | Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: actions]. | |
| AU-10(01) in AU-10 |
Association of Identities | (a) Bind the identity of the information producer with the information to [Assignment: strength of binding] ; and (b) Provide the means for authorized individuals to determine the identity of the producer of the information. | |
| AU-10(02) in AU-10 |
Validate Binding of Information Producer Identity | (a) Validate the binding of the information producer identity to the information at [Assignment: frequency] ; and (b) Perform [Assignment: actions] in the event of a validation error. | |
| AU-10(03) in AU-10 |
Chain of Custody | Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released. | |
| AU-10(04) in AU-10 |
Validate Binding of Information Reviewer Identity | (a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: security domains] ; and (b) Perform [Assignment: actions] in the event of a | |
| AU-10(05) in AU-10 |
Digital Signatures withdrawn | ||
| AU-11 | Audit Record Retention | Retain audit records for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. | |
| AU-11(01) in AU-11 |
Long-term Retrieval Capability | Employ [Assignment: measures] to ensure that long-term audit records generated by the system can be retrieved. | |
| AU-12 | Audit Record Generation | a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: system components]; b. Allow [Assignment: personnel or roles] to select the event types t | |
| AU-12(01) in AU-12 |
System-wide and Time-correlated Audit Trail | Compile audit records from [Assignment: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: level of tolerance]. | |
| AU-12(02) in AU-12 |
Standardized Formats | Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. | |
| AU-12(03) in AU-12 |
Changes by Authorized Individuals | Provide and implement the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds]. | |
| AU-12(04) in AU-12 |
Query Parameter Audits of Personally Identifiable Information | Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information. | |
| AU-13 | Monitoring for Information Disclosure | a. Monitor [Assignment: open-source information and/or information sites] [Assignment: frequency] for evidence of unauthorized disclosure of organizational information; and b. If an information disclosure is discovered: 1. Notify [Assignmen | |
| AU-13(01) in AU-13 |
Use of Automated Tools | Monitor open-source information and information sites using [Assignment: automated mechanisms]. | |
| AU-13(02) in AU-13 |
Review of Monitored Sites | Review the list of open-source information sites being monitored [Assignment: frequency]. | |
| AU-13(03) in AU-13 |
Unauthorized Replication of Information | Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner. | |
| AU-14 | Session Audit | a. Provide and implement the capability for [Assignment: users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: circumstances] ; and b. Develop, integrate, and use session audi | |
| AU-14(01) in AU-14 |
System Start-up | Initiate session audits automatically at system start-up. | |
| AU-14(02) in AU-14 |
Capture and Record Content withdrawn | ||
| AU-14(03) in AU-14 |
Remote Viewing and Listening | Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time. | |
| AU-15 | Alternate Audit Logging Capability withdrawn | ||
| AU-16 | Cross-organizational Audit Logging | Employ [Assignment: methods] for coordinating [Assignment: audit information] among external organizations when audit information is transmitted across organizational boundaries. | |
| AU-16(01) in AU-16 |
Identity Preservation | Preserve the identity of individuals in cross-organizational audit trails. | |
| AU-16(02) in AU-16 |
Sharing of Audit Information | Provide cross-organizational audit information to [Assignment: organizations] based on [Assignment: cross-organizational sharing agreements]. | |
| AU-16(03) in AU-16 |
Disassociability | Implement [Assignment: measures] to disassociate individuals from audit information transmitted across organizational boundaries. |
69 of 1196.