Device Class 3: Audit Generation
Control ID: AU-12 Audit Generation | Family: Audit and Accountability | Source: NIST 800-53r4 |
Control: The information system:
|
||
Supplemental Guidance: Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records. Related Controls: AC-3, AU-2, AU-3, AU-6, AU-7 |
||
Control Enhancements:
(1) Audit Generation | System-wide / Time-correlated Audit Trail The information system compiles audit records from [Assignment: organization-defined information system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail]. Supplemental Guidance: Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances. Related Controls: AU-8, AU-12 (3) Audit Generation | Changes By Authorized Individuals The information system provides the capability for [Assignment: organization-defined individuals or roles] to change the auditing to be performed on [Assignment: organization-defined information system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds]. Supplemental Guidance: This control enhancement enables organizations to extend or limit auditing as necessary to meet organizational requirements. Auditing that is limited to conserve information system resources may be extended to address certain threat situations. In addition, auditing may be limited to a specific set of events to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which audit actions are changed, for example, near real-time, within minutes, or within hours. Related Controls: AU-7 |
||
References: N/A | ||
Mechanisms:
No specific mechanisms are mandated or prohibited. |
||
Protocol Implementation Conformance Statements: N/A |