AU-14(01) System Start-up
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
System Start-up
Control
Initiate session audits automatically at system start-up.
Discussion
The automatic initiation of session audits at startup helps to ensure that the information being captured on selected individuals is complete and not subject to compromise through tampering by malicious threat actors.
Assessment objective
AU-14(01) session audits are initiated automatically at system start-up.
STIG rules that implement this control 12
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001003 CAT II The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001003 CAT II The macOS system must enable security auditing.
Application Security and Development V6R5
- APSC-DV-000910 CAT II The application must initiate session auditing upon startup.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-212015 CAT II Ubuntu 22.04 LTS must initiate session audits at system startup.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-102010 CAT II Ubuntu 24.04 LTS must initiate session audits at system startup.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200660 CAT II RHEL 10 must have the "audit" package installed.
- RHEL-10-200661 CAT II RHEL 10 must enable the audit service.
- RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-212055 CAT III RHEL 9 must enable auditing of processes that start prior to the audit daemon.
- RHEL-09-653010 CAT II RHEL 9 audit package must be installed.
- RHEL-09-653015 CAT II RHEL 9 audit service must be enabled.
- RHEL-09-653120 CAT III RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.