Assessment Objective

Determine if:

• AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• audit record retention policy and procedures
• security plan
• organization-defined retention period for audit records
• audit record archives
• audit logs
• audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record retention responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final