`AU-09` Protection of Audit Information

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AU Low baseline Moderate baseline High baseline

Title

Protection of Audit Information

Control

a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
b. Alert [Assignment: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

Discussion

Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.

Parameters

au-09_odp: personnel or roles

Related controls

ac-3, ac-6, au-11, au-14, au-15, au-6, mp-2, mp-4, pe-2, pe-3, pe-6, sa-8, sc-8, si-4

STIG rules that implement this control 102

Apple macOS 15 (Sequoia) V1R8

APPL-15-000030 CAT II The macOS system must configure audit log files to not contain access control lists (ACLs).
APPL-15-000031 CAT II The macOS system must configure the audit log folder to not contain access control lists (ACLs).
APPL-15-001003 CAT II The macOS system must enable security auditing.
APPL-15-001012 CAT II The macOS system must configure audit log files to be owned by root.
APPL-15-001013 CAT II The macOS system must configure audit log folders to be owned by root.
APPL-15-001014 CAT II The macOS system must configure the audit log files group to wheel.
APPL-15-001015 CAT II The macOS system must configure the audit log folders group to wheel.
APPL-15-001016 CAT II The macOS system must configure audit log files to mode 440 or less permissive.
APPL-15-001017 CAT II The macOS system must configure audit log folders to mode 700 or less permissive.
APPL-15-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-15-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-15-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-15-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-15-001110 CAT II The macOS system must configure audit_control group to wheel.
APPL-15-001120 CAT II The macOS system must configure audit_control owner to root.
APPL-15-001130 CAT II The macOS system must configure audit_control owner to mode 440 or less permissive.
APPL-15-001140 CAT II The macOS system must configure audit_control to not contain access control lists (ACLs).
APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000030 CAT II The macOS system must configure audit log files to not contain access control lists (ACLs).
APPL-26-000031 CAT II The macOS system must configure the audit log folder to not contain access control lists (ACLs).
APPL-26-001003 CAT II The macOS system must enable security auditing.
APPL-26-001012 CAT II The macOS system must configure audit log files to be owned by root.
APPL-26-001013 CAT II The macOS system must configure audit log folders to be owned by root.
APPL-26-001014 CAT II The macOS system must configure the audit log files group to wheel.
APPL-26-001015 CAT II The macOS system must configure the audit log folders group to wheel.
APPL-26-001016 CAT II The macOS system must configure audit log files to mode 440 or less permissive.
APPL-26-001017 CAT II The macOS system must configure audit log folders to mode 700 or less permissive.
APPL-26-001020 CAT II The macOS system must be configured to audit all deletions of object attributes.
APPL-26-001021 CAT II The macOS system must be configured to audit all changes of object attributes.
APPL-26-001022 CAT II The macOS system must be configured to audit all failed read actions on the system.
APPL-26-001023 CAT II The macOS system must be configured to audit all failed write actions on the system.
APPL-26-001110 CAT II The macOS system must configure audit_control group to wheel.
APPL-26-001120 CAT II The macOS system must configure audit_control owner to root.
APPL-26-001130 CAT II The macOS system must configure audit_control owner to mode 440 or less permissive.
APPL-26-001140 CAT II The macOS system must configure audit_control to not contain access control lists (ACLs).
APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.

Application Security and Development V6R5

APSC-DV-001280 CAT II The application must protect audit information from any type of unauthorized read access.
APSC-DV-001290 CAT II The application must protect audit information from unauthorized modification.
APSC-DV-001300 CAT II The application must protect audit information from unauthorized deletion.
APSC-DV-001310 CAT II The application must protect audit tools from unauthorized access.
APSC-DV-001320 CAT II The application must protect audit tools from unauthorized modification.
APSC-DV-001330 CAT II The application must protect audit tools from unauthorized deletion.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-232010 CAT II Ubuntu 22.04 LTS must have directories that contain system commands set to a mode of "755" or less permissive.
UBTU-22-232035 CAT II Ubuntu 22.04 LTS must configure audit tools with a mode of "755" or less permissive.
UBTU-22-232040 CAT II Ubuntu 22.04 LTS must have directories that contain system commands owned by "root".
UBTU-22-232045 CAT II Ubuntu 22.04 LTS must have directories that contain system commands group-owned by "root".
UBTU-22-232110 CAT II Ubuntu 22.04 LTS must configure audit tools to be owned by "root".
UBTU-22-653045 CAT II Ubuntu 22.04 LTS must be configured so that audit log files are not read- or write-accessible by unauthorized users.
UBTU-22-653050 CAT II Ubuntu 22.04 LTS must be configured to permit only authorized users ownership of the audit log files.
UBTU-22-653055 CAT II Ubuntu 22.04 LTS must permit only authorized groups ownership of the audit log files.
UBTU-22-653060 CAT II Ubuntu 22.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.
UBTU-22-654240 CAT II Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-901230 CAT II Ubuntu 24.04 LTS must configure audit tools with a mode of "0755" or less permissive.
UBTU-24-901240 CAT II Ubuntu 24.04 LTS must configure audit tools to be owned by root.
UBTU-24-901250 CAT II Ubuntu 24.04 LTS must configure the audit tools to be group owned by root.
UBTU-24-901260 CAT II Ubuntu 24.04 LTS must have directories that contain system commands set to a mode of "0755" or less permissive.
UBTU-24-901270 CAT II Ubuntu 24.04 LTS must have directories that contain system commands owned by root.
UBTU-24-901280 CAT II Ubuntu 24.04 LTS must have directories that contain system commands group-owned by root.
UBTU-24-901300 CAT II Ubuntu 24.04 LTS must be configured so that audit log files are not read or write-accessible by unauthorized users.
UBTU-24-901310 CAT II Ubuntu 24.04 LTS must be configured to permit only authorized users ownership of the audit log files.
UBTU-24-901350 CAT II Ubuntu 24.04 LTS must permit only authorized groups ownership of the audit log files.
UBTU-24-901380 CAT II Ubuntu 24.04 LTS must be configured so that the audit log directory is not write-accessible by unauthorized users.
UBTU-24-909000 CAT II Ubuntu 24.04 LTS audit system must protect auditing rules from unauthorized change.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000380 CAT II The Cisco router must be configured to protect audit information from unauthorized modification.
CISC-ND-000390 CAT II The Cisco router must be configured to protect audit information from unauthorized deletion.
CISC-ND-001000 CAT II The Cisco router must be configured to generate an alert for all audit failure events.

Microsoft Windows 11 V2R11

WN11-AU-000515 CAT II Windows 11 permissions for the Application event log must prevent access by non-privileged accounts.
WN11-AU-000520 CAT II Windows 11 permissions for the Security event log must prevent access by non-privileged accounts.
WN11-AU-000525 CAT II Windows 11 permissions for the System event log must prevent access by non-privileged accounts.
WN11-UR-000130 CAT II The "Manage auditing and security log" user right must only be assigned to the Administrators group.

Microsoft Windows Server 2022 V2R11

WN22-AU-000030 CAT II Windows Server 2022 permissions for the Application event log must prevent access by nonprivileged accounts.
WN22-AU-000040 CAT II Windows Server 2022 permissions for the Security event log must prevent access by nonprivileged accounts.
WN22-AU-000050 CAT II Windows Server 2022 permissions for the System event log must prevent access by nonprivileged accounts.
WN22-AU-000060 CAT II Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion.
WN22-UR-000170 CAT II Windows Server 2022 manage auditing and security log user right must only be assigned to the Administrators group.

Microsoft Windows Server 2025 V1R4

WN25-AU-000030 CAT II Windows Server 2025 permissions for the Application event log must prevent access by nonprivileged accounts.
WN25-AU-000040 CAT II Windows Server 2025 permissions for the Security event log must prevent access by nonprivileged accounts.
WN25-AU-000050 CAT II Windows Server 2025 permissions for the System event log must prevent access by nonprivileged accounts.
WN25-AU-000060 CAT II Windows Server 2025 Event Viewer must be protected from unauthorized modification and deletion.
WN25-UR-000170 CAT II The Windows Server 2025 "Manage auditing and security log" user right must only be assigned to the Administrators group.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-400165 CAT II RHEL 10 must enforce group ownership of audit logs by "root" or by a restricted logging group to prevent unauthorized read access.
RHEL-10-400170 CAT II RHEL 10 must enforce "root" ownership of the audit log directory to prevent unauthorized read access.
RHEL-10-400175 CAT II RHEL 10 must enforce "root" ownership of audit logs to prevent unauthorized access.
RHEL-10-400180 CAT II RHEL 10 must enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access.
RHEL-10-400185 CAT II RHEL 10 must set mode "0600" or less permissive for the audit logs file to prevent unauthorized access to the audit log.
RHEL-10-400190 CAT II RHEL 10 must enforce the audit log directory to have a mode of "0750" or less permissive to prevent unauthorized read access.
RHEL-10-400300 CAT II RHEL 10 must be configured so that audit tools are owned by "root".
RHEL-10-400305 CAT II RHEL 10 must be configured so that audit tools are group-owned by "root".
RHEL-10-400450 CAT II RHEL 10 must enforce a mode of "0755" or less permissive for audit tools.
RHEL-10-500015 CAT II RHEL 10 must write audit records to disk.
RHEL-10-900100 CAT II RHEL 10 must prevent unauthorized changes to the audit system.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-232035 CAT II RHEL 9 audit tools must have a mode of 0755 or less permissive.
RHEL-09-232103 CAT II RHEL 9 "/etc/audit/" must be owned by root.
RHEL-09-232104 CAT II RHEL 9 "/etc/audit/" must be group-owned by root.
RHEL-09-232220 CAT II RHEL 9 audit tools must be owned by root.
RHEL-09-232225 CAT II RHEL 9 audit tools must be group-owned by root.
RHEL-09-651025 CAT II RHEL 9 must use cryptographic mechanisms to protect the integrity of audit tools.
RHEL-09-653080 CAT II RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
RHEL-09-653085 CAT II RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
RHEL-09-653090 CAT II RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.
RHEL-09-654270 CAT II RHEL 9 audit system must protect logon UIDs from unauthorized change.
RHEL-09-654275 CAT II RHEL 9 audit system must protect auditing rules from unauthorized change.

AU-09 Protection of Audit Information