+AU-12 [L] Audit Record Generation
|
AU-12 [L] Audit Record Generation
Control
- Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
- Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
- Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
Discussion
Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.
Assessment Objective
- audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
- [Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
- audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.
Assessment Method
Examine
Audit and accountability policy
procedures addressing audit record generation
system security plan
privacy plan
system design documentation
system configuration settings and associated documentation
list of auditable events
system audit records
other relevant documents or records
Interview
Organizational personnel with audit record generation responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|