Assessment Objective

Determine if:

• AU-02a. [Assignment: event types] that the system is capable of logging are identified in support of the audit logging function;
• AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
• AU-02c.
  • AU-02c.[01] [Assignment: event types (subset of AU-02_ODP[01])] are specified for logging within the system;
  • AU-02c.[02] the specified event types are logged within the system [Assignment: frequency or situation];
• AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
• AU-02e. the event types selected for logging are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing auditable events
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system auditable events
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing system auditing

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final