AU Audit and Accountability

Control

1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
   1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] audit and accountability policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
   2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
3. Review and update the current audit and accountability:
   1. Policy [Assignement: frequency] and following [Assignement: events] ; and
   2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Assessment Objective

1. 1. an audit and accountability policy is developed and documented;
   2. the audit and accountability policy is disseminated to [Assignement: personnel or roles];
   3. audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;
   4. the audit and accountability procedures are disseminated to [Assignement: personnel or roles];
   5. 1. 1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose;
         2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope;
         3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles;
         4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities;
         5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment;
         6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities;
         7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;
3. 1. 1. the current audit and accountability policy is reviewed and updated [Assignement: frequency];
      2. the current audit and accountability policy is reviewed and updated following [Assignement: events];
   2. 1. the current audit and accountability procedures are reviewed and updated [Assignement: frequency];
      2. the current audit and accountability procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Interview

Control

1. Identify the types of events that the system is capable of logging in support of the audit function: [Assignement: event types];
2. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
3. Specify the following event types for logging within the system: [Assignement: organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];
4. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
5. Review and update the event types selected for logging [Assignement: frequency].

Discussion

Assessment Objective

1. [Assignement: event types] that the system is capable of logging are identified in support of the audit logging function;
2. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
3. 1. [Assignement: event types (subset of AU-02_ODP[01])] are specified for logging within the system;
   2. the specified event types are logged within the system [Assignement: frequency or situation];
4. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
5. the event types selected for logging are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

1. What type of event occurred;
2. When the event occurred;
3. Where the event occurred;
4. Source of the event;
5. Outcome of the event; and
6. Identity of any individuals, subjects, or objects/entities associated with the event.

Discussion

Assessment Objective

1. audit records contain information that establishes what type of event occurred;
2. audit records contain information that establishes when the event occurred;
3. audit records contain information that establishes where the event occurred;
4. audit records contain information that establishes the source of the event;
5. audit records contain information that establishes the outcome of the event;
6. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Alert [Assignement: personnel or roles] within [Assignement: time period] in the event of an audit logging process failure; and
2. Take the following additional actions: [Assignement: additional actions].

Discussion

Assessment Objective

1. [Assignement: personnel or roles] are alerted in the event of an audit logging process failure within [Assignement: time period];
2. [Assignement: additional actions] are taken in the event of an audit logging process failure.

Assessment Method

Examine

Interview

Control

1. Review and analyze system audit records [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
2. Report findings to [Assignement: personnel or roles] ; and
3. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Discussion

Assessment Objective

1. system audit records are reviewed and analyzed [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
2. findings are reported to [Assignement: personnel or roles];
3. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Assessment Method

Examine

Interview

Control

1. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
2. Does not alter the original content or time ordering of audit records.

Discussion

Assessment Objective

1. 1. an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
   2. an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
2. 1. an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records;
   2. an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.

Assessment Method

Examine

Interview

Control

1. Use internal system clocks to generate time stamps for audit records; and
2. Record time stamps for audit records that meet [Assignement: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Discussion

Assessment Objective

1. internal system clocks are used to generate timestamps for audit records;
2. timestamps are recorded for audit records that meet [Assignement: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.

Assessment Method

Examine

Interview

Control

1. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
2. Alert [Assignement: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

Discussion

Assessment Objective

1. audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
2. [Assignement: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
2. Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
3. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Assessment Objective

1. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
2. [Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
3. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Method

Examine

Interview

Control

1. Monitor [Assignement: open-source information and/or information sites] [Assignement: frequency] for evidence of unauthorized disclosure of organizational information; and
2. If an information disclosure is discovered:
   1. Notify [Assignement: personnel or roles] ; and
   2. Take the following additional actions: [Assignement: additional actions].

Discussion

Assessment Objective

1. [Assignement: open-source information and/or information sites] is/are monitored [Assignement: frequency] for evidence of unauthorized disclosure of organizational information;
2. 1. [Assignement: personnel or roles] are notified if an information disclosure is discovered;
   2. [Assignement: additional actions] are taken if an information disclosure is discovered.

Assessment Method

Examine

Interview

Control

1. Provide and implement the capability for [Assignement: users or roles] to [Selection(one-or-more): record; view; hear; log] the content of a user session under [Assignement: circumstances] ; and
2. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Discussion

Assessment Objective

1. 1. [Assignement: users or roles] are provided with the capability to [Selection(one-or-more): record; view; hear; log] the content of a user session under [Assignement: circumstances];
   2. the capability for [Assignement: users or roles] to [Selection(one-or-more): record; view; hear; log] the content of a user session under [Assignement: circumstances] is implemented;
2. 1. session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
   2. session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
   3. session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview