+AU-04 Audit Log Storage Capacity
---+AU-04(01) Transfer to Alternate Storage
|
AU-04 Audit Log Storage Capacity
Control
Allocate audit log storage capacity to accommodate [Assignement: audit log retention requirements].
Discussion
Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.
Assessment Objective
audit log storage capacity is allocated to accommodate [Assignement: audit log retention requirements].
Assessment Method
Examine
Audit and accountability policy
procedures addressing audit storage capacity
system security plan
privacy plan
system design documentation
system configuration settings and associated documentation
audit record storage requirements
audit record storage capability for system components
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
1. Oversigt
| Titel |
Standard |
|
AU-04(01) Transfer to Alternate Storage
|
Control
Transfer audit logs [Assignement: frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Discussion
Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to [AU-9(2)](#au-9.2) in that audit logs are transferred to a different entity. However, the purpose of selecting [AU-9(2)](#au-9.2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.
Assessment Objective
audit logs are transferred [Assignement: frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit storage capacity
procedures addressing transfer of system audit records to secondary or alternate systems
system design documentation
system configuration settings and associated documentation
logs of audit record transfers to secondary or alternate systems
system audit records transferred to secondary or alternate systems
other relevant documents or records
Interview
Organizational personnel with audit storage capacity planning responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|