The organization: a. Develops, documents, and disseminates to {{ insert: param, au-1_prm_1 }}: 1. An audit and accountability policy that addresses purpose, scope, roles, responsibilities, ma...

The organization reviews and updates the audited events {{ insert: param, au-2.3_prm_1 }}.

The information system generates audit records containing the following additional information: {{ insert: param, au-3.1_prm_1 }}.

The information system provides centralized management and configuration of the content to be captured in audit records generated by {{ insert: param, au-3.2_prm_1 }}.

The organization allocates audit record storage capacity in accordance with {{ insert: param, au-4_prm_1 }}.

The information system off-loads audit records {{ insert: param, au-4.1_prm_1 }} onto a different system or media than the system being audited.

The information system: a. Alerts {{ insert: param, au-5_prm_1 }} in the event of an audit processing failure; and b. Takes the following additional actions: {{ insert: param, au-5_prm_2 }}.

The information system provides a warning to {{ insert: param, au-5.1_prm_1 }} within {{ insert: param, au-5.1_prm_2 }} when allocated audit record storage volume reaches {{ insert: param, au-5.1_p...

The information system provides an alert in {{ insert: param, au-5.2_prm_1 }} to {{ insert: param, au-5.2_prm_2 }} when the following audit failure events occur: {{ insert: param, au-5.2_prm_3 }}.

The information system enforces configurable network communications traffic volume thresholds reflecting limits on auditing capacity and {{ insert: param, au-5.3_prm_1 }} network traffic above thos...

The information system invokes a {{ insert: param, au-5.4_prm_1 }} in the event of {{ insert: param, au-5.4_prm_2 }}, unless an alternate audit capability exists.

The organization: a. Reviews and analyzes information system audit records {{ insert: param, au-6_prm_1 }} for indications of {{ insert: param, au-6_prm_2 }}; and b. Reports findings to {{ inse...

The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

The information system provides the capability to centrally review and analyze audit records from multiple components within the system.

The organization integrates analysis of audit records with analysis of {{ insert: param, au-6.5_prm_1 }} to further enhance the ability to identify inappropriate or unusual activity.

The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, o...

The organization specifies the permitted actions for each {{ insert: param, au-6.7_prm_1 }} associated with the review, analysis, and reporting of audit information.

The organization performs a full text analysis of audited privileged commands in a physically distinct component or subsystem of the information system, or other information system that is dedicate...

The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.

The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence informati...

The information system provides an audit reduction and report generation capability that: a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigation...

The information system provides the capability to process audit records for events of interest based on {{ insert: param, au-7.1_prm_1 }}.

The information system provides the capability to sort and search audit records for events of interest based on the content of {{ insert: param, au-7.2_prm_1 }}.

The information system: a. Uses internal system clocks to generate time stamps for audit records; and b. Records time stamps for audit records that can be mapped to Coordinated Universal Time (...

The information system: (a) Compares the internal information system clocks {{ insert: param, au-8.1_prm_1 }} with {{ insert: param, au-8.1_prm_2 }}; and (b) Synchronizes the internal system cl...

The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

The information system writes audit trails to hardware-enforced, write-once media.

The information system backs up audit records {{ insert: param, au-9.2_prm_1 }} onto a physically different system or system component than the system or component being audited.

The information system implements cryptographic mechanisms to protect the integrity of audit information and audit tools.

The organization authorizes access to management of audit functionality to only {{ insert: param, au-9.4_prm_1 }}.

The organization enforces dual authorization for {{ insert: param, au-9.5_prm_1 }} of {{ insert: param, au-9.5_prm_2 }}.

The organization authorizes read-only access to audit information to {{ insert: param, au-9.6_prm_1 }}.

The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed {{ insert: param, au-10_prm_1 }}.

The information system: (a) Binds the identity of the information producer with the information to {{ insert: param, au-10.1_prm_1 }}; and (b) Provides the means for authorized individuals to d...

The information system: (a) Validates the binding of the information producer identity to the information at {{ insert: param, au-10.2_prm_1 }}; and (b) Performs {{ insert: param, au-10.2_prm_2...

The information system maintains reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.

The information system: (a) Validates the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer between {{ insert: param, au-...

The organization retains audit records for {{ insert: param, au-11_prm_1 }} to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational info...

The organization employs {{ insert: param, au-11.1_prm_1 }} to ensure that long-term audit records generated by the information system can be retrieved.

The information system: a. Provides audit record generation capability for the auditable events defined in AU-2 a. at {{ insert: param, au-12_prm_1 }}; b. Allows {{ insert: param, au-12_prm_2 }...

The information system compiles audit records from {{ insert: param, au-12.1_prm_1 }} into a system-wide (logical or physical) audit trail that is time-correlated to within {{ insert: param, au-12....

The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

The information system provides the capability for {{ insert: param, au-12.3_prm_1 }} to change the auditing to be performed on {{ insert: param, au-12.3_prm_2 }} based on {{ insert: param, au-12.3...

The organization monitors {{ insert: param, au-13_prm_1 }} {{ insert: param, au-13_prm_2 }} for evidence of unauthorized disclosure of organizational information.

The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.

The organization reviews the open source information sites being monitored {{ insert: param, au-13.2_prm_1 }}.

The information system provides the capability for authorized users to select a user session to capture/record or view/hear.

The information system initiates session audits at system start-up.

The information system provides the capability for authorized users to capture/record and log content related to a user session.

The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.

The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides {{ insert: param, au-15_prm_1 }}.

The organization employs {{ insert: param, au-16_prm_1 }} for coordinating {{ insert: param, au-16_prm_2 }} among external organizations when audit information is transmitted across organizational ...

The organization requires that the identity of individuals be preserved in cross-organizational audit trails.

The organization provides cross-organizational audit information to {{ insert: param, au-16.2_prm_1 }} based on {{ insert: param, au-16.2_prm_2 }}.