CM-05(01) Automated Access Enforcement and Audit Records
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Automated Access Enforcement and Audit Records
Control
(a) Enforce access restrictions using [Assignment: automated mechanisms] ; and
(b) Automatically generate audit records of the enforcement actions.
Discussion
Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.
Parameters
cm-05.01_odp: automated mechanisms
Related controls
au-12, au-2, au-6, au-7, cm-11, cm-6, si-12
STIG rules that implement this control 39
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000100 CAT II The macOS system must disable root login.
- APPL-15-001001 CAT II The macOS system must be configured to audit all administrative action events.
- APPL-15-001003 CAT II The macOS system must enable security auditing.
- APPL-15-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
- APPL-15-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
- APPL-15-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
- APPL-15-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
- APPL-15-001024 CAT II The macOS system must be configured to audit all failed program execution on the system.
- APPL-15-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.
- APPL-15-001100 CAT II The macOS system must disable root login for SSH.
- APPL-15-002063 CAT II The macOS system must disable the guest account.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000100 CAT II The macOS system must disable root login.
- APPL-26-001001 CAT II The macOS system must be configured to audit all administrative action events.
- APPL-26-001003 CAT II The macOS system must enable security auditing.
- APPL-26-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
- APPL-26-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
- APPL-26-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
- APPL-26-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
- APPL-26-001024 CAT II The macOS system must be configured to audit all failed program execution on the system.
- APPL-26-001044 CAT II The macOS system must be configured to audit all authorization and authentication events.
- APPL-26-001100 CAT II The macOS system must disable root login for SSH.
- APPL-26-002063 CAT II The macOS system must disable the guest account.
Application Security and Development V6R5
- APSC-DV-001410 CAT II The application must enforce access restrictions associated with changes to application configuration.
- APSC-DV-001420 CAT II The application must audit who makes configuration changes to the application.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
- UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
- UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Microsoft Windows 11 V2R11
- WN11-AU-000045 CAT II The system must be configured to audit Detailed Tracking - PNP Activity successes.
- WN11-AU-000050 CAT II The system must be configured to audit Detailed Tracking - Process Creation successes.
Microsoft Windows Server 2025 V1R4
- WN25-SH-000110 CAT II Windows Server 2025 OpenSSH must not allow GSSAPI authentication.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
- RHEL-10-700510 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Generic Security Service Application Program Interface (GSSAPI) authentication.
- RHEL-10-700520 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow Kerberos authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-255135 CAT II RHEL 9 SSH daemon must not allow GSSAPI authentication.
- RHEL-09-255140 CAT II RHEL 9 SSH daemon must not allow Kerberos authentication.
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.