+03.03.03 Audit Record Generation

03.03.03 Audit Record Generation

Statement

  • a. Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02.

  • b. Retain audit records for a time period consistent with the records retention policy.

Guidance

Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records, including the access control or flow control rules invoked and the individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements.

Assessment objective

audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02 are generated.

Assessment objective

audit records are retained for a time period consistent with the records retention policy.

Assessment method

  • audit and accountability policy and procedures procedures for audit record generation system design documentation list of auditable events system audit records audit record retention policy and procedures organization-defined retention period for audit records audit record archives system configuration settings system security plan other relevant documents or records

Assessment method

  • personnel with audit record generation responsibilities personnel with audit record retention responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

  • mechanisms for implementing the audit record generation capability

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by 03.03.03 Audit Record Generation – Assessment Procedure
is blocked by System Generated Event Logs & Security-Relevant Telemetry
is blocked by Protection of Event Logs & Security-Relevant Telemetry
is blocked by Event Log & Security-Relevant Telemetry Retention