NIST SP 800-53A

________________________________________________________________________________________________

AU-3(2) CONTENT OF AUDIT RECORDS

AU-3(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the information system components for which the content of audit records generated is centrally managed; and

(ii)the organization centrally manages the content of audit records generated by organization-defined information system components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing content of audit records; information system design documentation; list of organization-defined auditable events; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing centralized management of audit record content].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit storage capacity; information system design documentation; organization-defined audit record storage capacity for information system components that store audit records; list of organization-defined auditable events; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Audit record storage capacity and related configuration settings].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; information system design documentation; security plan; information system configuration settings and associated documentation; list of personnel to be notified in case of an audit processing failure; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing information system response to audit processing failures].

AU-5(1) RESPONSE TO AUDIT PROCESSING FAILURES

AU-5(1).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the percentage of maximum audit record storage capacity that, if reached, requires a warning to be provided; and

(ii)the information system provides a warning when the allocated audit record storage volume reaches the organization-defined percentage of maximum audit record storage capacity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; information system design documentation; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing audit storage limit warnings].

________________________________________________________________________________________________

AU-5(2) RESPONSE TO AUDIT PROCESSING FAILURES

AU-5(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines audit failure events requiring real-time alerts; and

(ii)the information system provides a real-time alert when organization-defined audit failure events occur.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; information system design documentation; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing real time audit alerts when organizationdefined audit failure events occur].

AU-5(3) RESPONSE TO AUDIT PROCESSING FAILURES

AU-5(3).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the information system enforces configurable traffic volume thresholds representing auditing capacity for network traffic;

(ii)the organization defines if the network traffic above configurable traffic volume thresholds are rejected or delayed; and

(iii)the information system rejects or delays, as defined by the organization, network traffic generated above configurable traffic volume thresholds.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; information system design documentation; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Information system capability implementing configurable traffic volume thresholds].

AU-5(4) RESPONSE TO AUDIT PROCESSING FAILURES

AU-5(4).1 ASSESSMENT OBJECTIVE:

Determine if the information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; information system design documentation; security plan; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Information system capability invoking system shutdown in the event of an audit failure].

________________________________________________________________________________________________

________________________________________________________________________________________________

AU-6(1) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; procedures for investigating and responding to suspicious activities; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system audit review, analysis, and reporting responsibilities].

Test: [SELECT FROM: Information system capability integrating audit review, analysis, and reporting into an organizational process for investigation and response to suspicious activities].

AU-6(2) AUDIT REVIEW, ANALYSIS, AND REPORTING

[Withdrawn: Incorporated into SI-4].

AU-6(2).1 ASSESSMENT OBJECTIVE:

[Withdrawn: Incorporated into SI-4].

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

[Withdrawn: Incorporated into SI-4].

AU-6(3) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; information system audit records across different repositories; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system audit review, analysis, and reporting responsibilities].

________________________________________________________________________________________________

AU-6(4) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(4).1 ASSESSMENT OBJECTIVE:

Determine if the information system centralizes the review and analysis of audit records from multiple components within the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; security plan; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system audit review, analysis, and reporting responsibilities].

Test: [SELECT FROM: Information system capability for centralizing review and analysis of audit records from multiple information system components].

AU-6(5) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(5).1 ASSESSMENT OBJECTIVE:

Determine if the organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to enhance the ability to identify inappropriate or unusual activity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation; other relevant documents or records].

Test: [SELECT FROM: Information system capability for centralizing review and analysis of audit records from multiple information system components].

AU-6(6) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(6).1 ASSESSMENT OBJECTIVE:

Determine if the organization correlates information from audit records with information obtained from monitoring physical access to enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; documentation providing evidence of correlated information obtained from audit records and physical access monitoring records; security plan; other relevant documents or records].

Test: [SELECT FROM: Information system capability for centralizing review and analysis of audit records from multiple information system components].

________________________________________________________________________________________________

AU-6(7) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(7).1 ASSESSMENT OBJECTIVE:

Determine if the organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; security plan; other relevant documents or records].

AU-6(8) AUDIT REVIEW, ANALYSIS, AND REPORTING

[Withdrawn: Incorporated into SI-4].

AU-6(8).1 ASSESSMENT OBJECTIVE:

[Withdrawn: Incorporated into SI-4].

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

[Withdrawn: Incorporated into SI-4].

AU-6(9) AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6(9).1 ASSESSMENT OBJECTIVE:

Determine if the organization performs full-text analysis of privileged functions executed in a physically dedicated information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system audit review, analysis, and reporting responsibilities].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit reduction and report generation; information system design documentation; audit reduction, review, and reporting tools; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with information system audit review, analysis, and reporting responsibilities].

Test: [SELECT FROM: Audit reduction and report generation capability].

AU-7(1) AUDIT REDUCTION AND REPORT GENERATION

AU-7(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system provides the capability to automatically process audit records for events of interest based on selectable event criteria.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing audit reduction and report generation; information system design documentation; information system configuration settings and associated documentation; documented criteria for selectable events to audit; audit reduction, review, and reporting tools; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Audit reduction and report generation capability].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy; procedures addressing time stamp generation; security plan; information system design documentation; information system configuration settings and associated documentation; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing internal information system clock synchronization].