Assessment Objective
Determine if:
- AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
Assessment Methods
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- audit record retention policy and procedures
- security plan
- organization-defined retention period for audit records
- audit record archives
- audit logs
- audit records
- other relevant documents or records
Interview
- Organizational personnel with audit record retention responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | AU-11 [H] Audit Record Retention |