Assessment Objective

Determine if:

• audit records contain information that establishes what type of event occurred.
• audit records contain information that establishes when the event occurred.
• audit records contain information that establishes where the event occurred.
• audit records contain information that establishes the source of the event.
• audit records contain information that establishes the outcome of the event.
• audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.
• additional information for audit records is provided, as needed.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for the content of audit records
• list of organization-defined auditable events
• system design documentation
• system configuration settings
• system audit records
• system incident reports
• system security plan
• other relevant documents or records

Interview

• personnel with audit and accountability responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing system auditing of auditable events
• system audit capability

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final