Assessment Objective

Determine if:

• system audit records are reviewed and analyzed [Assignment: frequency] for indications and the potential impact of inappropriate or unusual activity.
• findings are reported to organizational personnel or roles.
• audit records across different repositories are analyzed to gain organization-wide situational awareness.
• audit records across different repositories are correlated to gain organization-wide situational awareness.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for audit record review, analysis, and reporting
• reports of audit record findings
• records of actions taken in response to reviews and analyses of audit records
• system design documentation
• system audit records across different repositories
• system security plan
• system configuration settings
• other relevant documents or records

Interview

• personnel with audit record review, analysis, and reporting responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting the analysis and correlation of audit records

Tichete legate

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final