AU-12(03) Changes by Authorized Individuals
All changes in this version
Title
Changes by Authorized Individuals
Control
Provide and implement the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds].
Discussion
Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).
Parameters
au-12.03_odp.01: individuals or roles
au-12.03_odp.02: system components
au-12.03_odp.03: selectable event criteria
au-12.03_odp.04: time thresholds
Related controls
ac-3
STIG rules that implement this control 13
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001003 CAT II The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001003 CAT II The macOS system must enable security auditing.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653010 CAT II Ubuntu 22.04 LTS must have the "auditd" package installed.
- UBTU-22-653015 CAT II Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100400 CAT II Ubuntu 24.04 LTS must have the "auditd" package installed.
- UBTU-24-100410 CAT II Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoW-defined auditable events and actions in near real time.
Microsoft Windows 11 V2R11
- WN11-AU-000030 CAT II The system must be configured to audit Account Management - Security Group Management successes.
Microsoft Windows Server 2022 V2R11
- WN22-UR-000170 CAT II Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.
Microsoft Windows Server 2025 V1R4
- WN25-UR-000170 CAT II The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.