+AU [L] Audit and Accountability
---+AU-01 [L] Policy and Procedures
---+AU-02 [L] Event Logging
---+AU-03 [L] Content of Audit Records
---+AU-04 [L] Audit Log Storage Capacity
---+AU-05 [L] Response to Audit Logging Process Failures
---+AU-06 [L] Audit Record Review, Analysis, and Reporting
---+AU-08 [L] Time Stamps
---+AU-09 [L] Protection of Audit Information
---+AU-11 [L] Audit Record Retention
---+AU-12 [L] Audit Record Generation

AU [L] Audit and Accountability

Audit and Accountability

1. Přehled

AU-01 [L] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] audit and accountability policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
  3. Review and update the current audit and accountability:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Audit and accountability policy and procedures address the controls in the AU family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of audit and accountability policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to audit and accountability policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. an audit and accountability policy is developed and documented;
    2. the audit and accountability policy is disseminated to [Assignement: personnel or roles];
    3. audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;
    4. the audit and accountability procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;
      1. the current audit and accountability policy is reviewed and updated [Assignement: frequency];
      2. the current audit and accountability policy is reviewed and updated following [Assignement: events];
      1. the current audit and accountability procedures are reviewed and updated [Assignement: frequency];
      2. the current audit and accountability procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Audit and accountability policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities
AU-02 [L] Event Logging

Control

  1. Identify the types of events that the system is capable of logging in support of the audit function: [Assignement: event types];
  2. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
  3. Specify the following event types for logging within the system: [Assignement: organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type];
  4. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
  5. Review and update the event types selected for logging [Assignement: frequency].

Discussion

An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system. To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage. Event logging requirements, including the need to log specific event types, may be referenced in other controls and control enhancements. These include [AC-2(4)](#ac-2.4), [AC-3(10)](#ac-3.10), [AC-6(9)](#ac-6.9), [AC-17(1)](#ac-17.1), [CM-3f](#cm-3_smt.f), [CM-5(1)](#cm-5.1), [IA-3(3)(b)](#ia-3.3_smt.b), [MA-4(1)](#ma-4.1), [MP-4(2)](#mp-4.2), [PE-3](#pe-3), [PM-21](#pm-21), [PT-7](#pt-7), [RA-8](#ra-8), [SC-7(9)](#sc-7.9), [SC-7(15)](#sc-7.15), [SI-3(8)](#si-3.8), [SI-4(22)](#si-4.22), [SI-7(8)](#si-7.8) , and [SI-10(1)](#si-10.1) . Organizations include event types that are required by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Audit records can be generated at various levels, including at the packet level as information traverses the network. Selecting the appropriate level of event logging is an important part of a monitoring and auditing capability and can identify the root causes of problems. When defining event types, organizations consider the logging necessary to cover related event types, such as the steps in distributed, transaction-based processes and the actions that occur in service-oriented architectures.

Assessment Objective

  1. [Assignement: event types] that the system is capable of logging are identified in support of the audit logging function;
  2. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
    1. [Assignement: event types (subset of AU-02_ODP[01])] are specified for logging within the system;
    2. the specified event types are logged within the system [Assignement: frequency or situation];
  4. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
  5. the event types selected for logging are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Audit and accountability policy procedures addressing auditable events system security plan privacy plan system design documentation system configuration settings and associated documentation system audit records system auditable events other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
AU-03 [L] Content of Audit Records

Control

Ensure that audit records contain information that establishes the following:
  1. What type of event occurred;
  2. When the event occurred;
  3. Where the event occurred;
  4. Source of the event;
  5. Outcome of the event; and
  6. Identity of any individuals, subjects, or objects/entities associated with the event.

Discussion

Audit record content that may be necessary to support the auditing function includes event descriptions (item a), time stamps (item b), source and destination addresses (item c), user or process identifiers (items d and f), success or fail indications (item e), and filenames involved (items a, c, e, and f) . Event outcomes include indicators of event success or failure and event-specific results, such as the system security and privacy posture after the event occurred. Organizations consider how audit records can reveal information about individuals that may give rise to privacy risks and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the trail records inputs or is based on patterns or time of usage.

Assessment Objective

  1. audit records contain information that establishes what type of event occurred;
  2. audit records contain information that establishes when the event occurred;
  3. audit records contain information that establishes where the event occurred;
  4. audit records contain information that establishes the source of the event;
  5. audit records contain information that establishes the outcome of the event;
  6. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing content of audit records system design documentation system configuration settings and associated documentation list of organization-defined auditable events system audit records system incident reports other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
AU-04 [L] Audit Log Storage Capacity

Control

Allocate audit log storage capacity to accommodate [Assignement: audit log retention requirements].

Discussion

Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.

Assessment Objective

audit log storage capacity is allocated to accommodate [Assignement: audit log retention requirements].

Assessment Method

Examine

Audit and accountability policy procedures addressing audit storage capacity system security plan privacy plan system design documentation system configuration settings and associated documentation audit record storage requirements audit record storage capability for system components system audit records other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-05 [L] Response to Audit Logging Process Failures

Control

  1. Alert [Assignement: personnel or roles] within [Assignement: time period] in the event of an audit logging process failure; and
  2. Take the following additional actions: [Assignement: additional actions].

Discussion

Audit logging process failures include software and hardware errors, failures in audit log capturing mechanisms, and reaching or exceeding audit log storage capacity. Organization-defined actions include overwriting oldest audit records, shutting down the system, and stopping the generation of audit records. Organizations may choose to define additional actions for audit logging process failures based on the type of failure, the location of the failure, the severity of the failure, or a combination of such factors. When the audit logging process failure is related to storage, the response is carried out for the audit log storage repository (i.e., the distinct system component where the audit logs are stored), the system on which the audit logs reside, the total audit log storage capacity of the organization (i.e., all audit log storage repositories combined), or all three. Organizations may decide to take no additional actions after alerting designated roles or personnel.

Assessment Objective

  1. [Assignement: personnel or roles] are alerted in the event of an audit logging process failure within [Assignement: time period];
  2. [Assignement: additional actions] are taken in the event of an audit logging process failure.

Assessment Method

Examine

Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan privacy plan system configuration settings and associated documentation list of personnel to be notified in case of an audit processing failure system audit records other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-06 [L] Audit Record Review, Analysis, and Reporting

Control

  1. Review and analyze system audit records [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
  2. Report findings to [Assignement: personnel or roles] ; and
  3. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Discussion

Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.

Assessment Objective

  1. system audit records are reviewed and analyzed [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
  2. findings are reported to [Assignement: personnel or roles];
  3. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit review, analysis, and reporting reports of audit findings records of actions taken in response to reviews/analyses of audit records other relevant documents or records

Interview

Organizational personnel with audit review, analysis, and reporting responsibilities organizational personnel with information security and privacy responsibilities
AU-08 [L] Time Stamps

Control

  1. Use internal system clocks to generate time stamps for audit records; and
  2. Record time stamps for audit records that meet [Assignement: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Discussion

Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks (e.g., clocks synchronizing within hundreds of milliseconds or tens of milliseconds). Organizations may define different time granularities for different system components. Time service can be critical to other security capabilities such as access control and identification and authentication, depending on the nature of the mechanisms used to support those capabilities.

Assessment Objective

  1. internal system clocks are used to generate timestamps for audit records;
  2. timestamps are recorded for audit records that meet [Assignement: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing timestamp generation system design documentation system configuration settings and associated documentation system audit records other relevant documents or records

Interview

Organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-09 [L] Protection of Audit Information

Control

  1. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
  2. Alert [Assignement: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

Discussion

Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.

Assessment Objective

  1. audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
  2. [Assignement: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system audit records audit tools other relevant documents or records

Interview

Organizational personnel with audit and accountability responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-11 [L] Audit Record Retention

Control

Retain audit records for [Assignement: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Discussion

Organizations retain audit records until it is determined that the records are no longer needed for administrative, legal, audit, or other operational purposes. This includes the retention and availability of audit records relative to Freedom of Information Act (FOIA) requests, subpoenas, and law enforcement actions. Organizations develop standard categories of audit records relative to such types of actions and standard response processes for each type of action. The National Archives and Records Administration (NARA) General Records Schedules provide federal policy on records retention.

Assessment Objective

audit records are retained for [Assignement: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan audit record retention policy and procedures security plan organization-defined retention period for audit records audit record archives audit logs audit records other relevant documents or records

Interview

Organizational personnel with audit record retention responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
AU-12 [L] Audit Record Generation

Control

  1. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
  2. Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
  3. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

Assessment Objective

  1. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
  2. [Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
  3. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Method

Examine

Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace