+AU-06(06) [H] Correlation with Physical Monitoring
|
AU-06(06) [H] Correlation with Physical Monitoring
Control
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Discussion
The correlation of physical audit record information and the audit records from systems may assist organizations in identifying suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual’s identity for logical access to certain systems with the additional physical security information that the individual was present at the facility when the logical access occurred may be useful in investigations.
Assessment Objective
information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Assessment Method
Examine
Audit and accountability policy
procedures addressing audit review, analysis, and reporting
procedures addressing physical access monitoring
system design documentation
system configuration settings and associated documentation
documentation providing evidence of correlated information obtained from audit records and physical access monitoring records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with physical access monitoring responsibilities
organizational personnel with information security and privacy responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|