Assessment Objective
Determine if:
- AU-07(01)[01] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are provided;
- AU-07(01)[02] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are implemented.
Assessment Methods
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing audit reduction and report generation
- system design documentation
- system configuration settings and associated documentation
- audit reduction, review, analysis, and reporting tools
- audit record criteria (fields) establishing events of interest
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with audit reduction and report generation responsibilities
- organizational personnel with information security and privacy responsibilities
- system developers
Test
- Audit reduction and report generation capability
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | AU-07(01) Automatic Processing |