Assessment Objective

Determine if:

• an audit record reduction and report generation capability that supports audit record review is implemented.
• an audit record reduction and report generation capability that supports audit record analysis is implemented.
• an audit record reduction and report generation capability that supports audit record reporting requirements is implemented.
• an audit record reduction and report generation capability that supports after-the-fact investigations of incidents is implemented.
• the original content of audit records is preserved.
• the original time ordering of audit records is preserved.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for audit record reduction and report generation
• audit record reduction, review, analysis, and reporting tools
• system audit records
• system design documentation
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with audit record reduction and report generation responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting audit record reduction and report generation capability

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final