03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components

Statement

Store audit records in a repository that is part of a physically different system or system component than the system or component being audited.

Guidance

Storing audit records in a repository that is separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components preserves the confidentiality, integrity, and availability of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or system components applies to the initial generation and backup or long-term storage of audit records. This requirement enhances SP 800-171 requirement 03.03.08.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited.

Assessment method

• Audit and accountability policy system security plan procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system or media storing backups of system audit records system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms implementing the backing up of audit records

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final