BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

AU-06 Audit Record Review, Analysis, and Reporting

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded AU Low baselineModerate baselineHigh baseline

Title

Audit Record Review, Analysis, and Reporting

Control

a. Review and analyze system audit records [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
b. Report findings to [Assignment: personnel or roles] ; and
c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Discussion

Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.

Parameters

au-06_odp.01: frequency
au-06_odp.02: inappropriate or unusual activity
au-06_odp.03: personnel or roles

Related controls

ac-17, ac-2, ac-3, ac-5, ac-6, ac-7, au-16, au-7, ca-2, ca-7, cm-10, cm-11, cm-2, cm-5, cm-6, ia-2, ia-3, ia-5, ia-8, ir-5, ma-4, mp-4, pe-3, pe-6, ra-5, sa-8, sc-7, si-3, si-4, si-7

STIG rules that implement this control 1

Application Security and Development V6R5