Assessment Objective

Determine if:

• AU-06(05) analysis of audit records is integrated with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information, and associated documentation
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing the capability to integrate analysis of audit records with analysis of data/information sources

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final