+AU-06 [M] Audit Record Review, Analysis, and Reporting
---+AU-06(01) [M] Automated Process Integration
---+AU-06(03) [M] Correlate Audit Record Repositories
|
AU-06 [M] Audit Record Review, Analysis, and Reporting
Control
- Review and analyze system audit records [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
- Report findings to [Assignement: personnel or roles] ; and
- Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Discussion
Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.
Assessment Objective
- system audit records are reviewed and analyzed [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
- findings are reported to [Assignement: personnel or roles];
- the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
reports of audit findings
records of actions taken in response to reviews/analyses of audit records
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
1. Übersicht
| Bezeichnung |
Standard |
|
AU-06(01) [M] Automated Process Integration
|
Control
Integrate audit record review, analysis, and reporting processes using [Assignement: automated mechanisms].
Discussion
Organizational processes that benefit from integrated audit record review, analysis, and reporting include incident response, continuous monitoring, contingency planning, investigation and response to suspicious activities, and Inspector General audits.
Assessment Objective
audit record review, analysis, and reporting processes are integrated using [Assignement: automated mechanisms].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
procedures addressing investigation and response to suspicious activities
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
|
|
AU-06(03) [M] Correlate Audit Record Repositories
|
Control
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Discussion
Organization-wide situational awareness includes awareness across all three levels of risk management (i.e., organizational level, mission/business process level, and information system level) and supports cross-organization awareness.
Assessment Objective
audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
system design documentation
system configuration settings and associated documentation
system audit records across different repositories
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|