+AU-12 Audit Record Generation
---+AU-12(01) System-wide and Time-correlated Audit Trail
---+AU-12(02) Standardized Formats
---+AU-12(03) Changes by Authorized Individuals
---+AU-12(04) Query Parameter Audits of Personally Identifiable Information

AU-12 Audit Record Generation

Control

  1. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
  2. Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
  3. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

Assessment Objective

  1. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
  2. [Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
  3. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Method

Examine

Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1. Ħarsa ġenerali

AU-12(01) System-wide and Time-correlated Audit Trail

Control

Compile audit records from [Assignement: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance].

Discussion

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.

Assessment Objective

audit records from [Assignement: system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance].

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-wide audit trail (logical or physical) system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-12(02) Standardized Formats

Control

Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

Discussion

Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails.

Assessment Objective

a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-wide audit trail (logical or physical) system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with security responsibilities system/network administrators system developers
AU-12(03) Changes by Authorized Individuals

Control

Provide and implement the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds].

Discussion

Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).

Assessment Objective

  1. the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is provided;
  2. the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is implemented.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-generated list of individuals or roles authorized to change auditing to be performed system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-12(04) Query Parameter Audits of Personally Identifiable Information

Control

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.

Discussion

Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.

Assessment Objective

  1. the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;
  2. the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.

Assessment Method

Examine

Audit and accountability policy system security plan privacy plan procedures addressing audit record generation query event records system design documentation system configuration settings and associated documentation map of system data actions system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by AU-12 Audit Record Generation – Assessment Procedure
is blocked by Monitoring Reporting