`AU-12(03)` Changes by Authorized Individuals

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded AU High baseline part of AU-12

Title

Changes by Authorized Individuals

Control

Provide and implement the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds].

Discussion

Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).

Parameters

au-12.03_odp.01: individuals or roles
au-12.03_odp.02: system components
au-12.03_odp.03: selectable event criteria
au-12.03_odp.04: time thresholds

Related controls

ac-3

STIG rules that implement this control 13

Apple macOS 15 (Sequoia) V1R8

APPL-15-001003 CAT II The macOS system must enable security auditing.

Apple macOS 26 (Tahoe) V1R4

APPL-26-001003 CAT II The macOS system must enable security auditing.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.