+AU-12 [H] Audit Record Generation
---+AU-12(01) [H] System-wide and Time-correlated Audit Trail
---+AU-12(03) [H] Changes by Authorized Individuals

AU-12 [H] Audit Record Generation

Control

  1. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
  2. Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
  3. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

Assessment Objective

  1. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
  2. [Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
  3. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Method

Examine

Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1. Přehled

AU-12(01) [H] System-wide and Time-correlated Audit Trail

Control

Compile audit records from [Assignement: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance].

Discussion

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.

Assessment Objective

audit records from [Assignement: system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance].

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-wide audit trail (logical or physical) system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-12(03) [H] Changes by Authorized Individuals

Control

Provide and implement the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds].

Discussion

Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).

Assessment Objective

  1. the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is provided;
  2. the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is implemented.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-generated list of individuals or roles authorized to change auditing to be performed system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by AU-12 [H] Audit Record Generation – Assessment Procedure
is blocked by Monitoring Reporting