Audit and Accountability

Overview:Alert in the event of an audit process failure. Action Items:3.3.4[a]Determine if: personnel or roles to be alerted in the event of an audit logging process failure are identified. 3.3.4[b]Determine if: types of audit logging process... Read More

Overview:Review and update audited events. Action Items:3.3.3[a]Determine if: a process for determining when to review logged events is defined. 3.3.3[b]Determine if: event types being logged are reviewed in accordance with the defined review process... Read More

Overview:Provide audit reduction and report generation to support on-demand analysis and reporting. Action Items:3.3.6[a]Determine if: an audit record reduction capability that supports on-demand analysis is provided. 3.3.6[b]Determine if: a report... Read More

Overview:Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity. Action Items:3.3.1[a... Read More

Overview:Limit management of audit functionality to a subset of privileged users. Action Items:3.3.9[a]Determine if: a subset of privileged users granted access to manage audit logging functionality is defined. 3.3.9[b]Determine if: management of... Read More

Overview:Use automated mechanisms to integrate and correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity. Action Items:3.3.5[a]Determine if: audit... Read More

Overview:Protect audit information and audit tools from unauthorized access, modification, and deletion. Action Items:3.3.8[a]Determine if: audit information is protected from unauthorized access. 3.3.8[b]Determine if: audit information is protected... Read More

Overview:Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. Action Items:3.3.7[a]Determine if: internal system clocks are used to... Read More

Overview:Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions. Action Items:3.3.2[a]Determine if: the content of the audit records needed to support the... Read More