03.03.02E Real-Time Alerts for Audit Processing Failures

Statement

Provide an alert within {{ insert: param, A.03.03.02E.ODP.01 }} to {{ insert: param, A.03.03.02E.ODP.02 }} when the following audit failure events occur: {{ insert: param, A.03.03.02E.ODP.03 }}.

Guidance

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less). This requirement enhances SP 800-171 requirement 03.03.04.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

an alert is provided within {{ insert: param, A.03.03.02E.ODP.01 }} to {{ insert: param, A.03.03.02E.ODP.02 }} when {{ insert: param, A.03.03.02E.ODP.03 }} occur.

Assessment method

• Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan system configuration settings and associated documentation system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final