+AU-12 Audit Record Generation
---+AU-12(01) System-wide and Time-correlated Audit Trail
---+AU-12(02) Standardized Formats
---+AU-12(03) Changes by Authorized Individuals
---+AU-12(04) Query Parameter Audits of Personally Identifiable Information

AU-12 Audit Record Generation

Control

Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignement: system components];
Allow [Assignement: personnel or roles] to select the event types that are to be logged by specific components of the system; and
Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).

Discussion

Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.

Assessment Objective

audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignement: system components];
[Assignement: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Method

Examine

Audit and accountability policy procedures addressing audit record generation system security plan privacy plan system design documentation system configuration settings and associated documentation list of auditable events system audit records other relevant documents or records

Interview

Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1. Visão geral

Título	Norma
AU-12(01) System-wide and Time-correlated Audit Trail	Control Compile audit records from [Assignement: system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance]. Discussion Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances. Assessment Objective audit records from [Assignement: system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignement: level of tolerance]. Assessment Method Examine Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-wide audit trail (logical or physical) system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-12(02) Standardized Formats	Control Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. Discussion Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails. Assessment Objective a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format. Assessment Method Examine Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-wide audit trail (logical or physical) system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with security responsibilities system/network administrators system developers
AU-12(03) Changes by Authorized Individuals	Control Provide and implement the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds]. Discussion Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours). Assessment Objective the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is provided; the capability for [Assignement: individuals or roles] to change the logging to be performed on [Assignement: system components] based on [Assignement: selectable event criteria] within [Assignement: time thresholds] is implemented. Assessment Method Examine Audit and accountability policy system security plan privacy plan procedures addressing audit record generation system design documentation system configuration settings and associated documentation system-generated list of individuals or roles authorized to change auditing to be performed system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers
AU-12(04) Query Parameter Audits of Personally Identifiable Information	Control Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information. Discussion Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel. Assessment Objective the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided; the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented. Assessment Method Examine Audit and accountability policy system security plan privacy plan procedures addressing audit record generation query event records system design documentation system configuration settings and associated documentation map of system data actions system audit records other relevant documents or records Interview Organizational personnel with audit record generation responsibilities organizational personnel with information security and privacy responsibilities system/network administrators system developers

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos
Fonte	Requisito

3. Regulamentos relacionados

Regulamentos
Fonte	Regulamentação

Pedidos ligados

Ligações
Tipo de ligação	Pedido
is blocked by	AU-12 Audit Record Generation – Assessment Procedure
is blocked by	Monitoring Reporting

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.