a. Develop, document, and disseminate to {{ insert: param, au-1_prm_1 }}: 1. {{ insert: param, au-01_odp.03 }} audit and accountability policy that: (a) Addresses purpose, scope, roles,...

a. Identify the types of events that the system is capable of logging in support of the audit function: {{ insert: param, au-02_odp.01 }}; b. Coordinate the event logging function with other or...

Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event...

Generate audit records containing the following additional information: {{ insert: param, au-03.01_odp }}.

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: {{ insert: param, au-03.03_odp }}.

Allocate audit log storage capacity to accommodate {{ insert: param, au-04_odp }}.

Transfer audit logs {{ insert: param, au-04.01_odp }} to a different system, system component, or media other than the system or system component conducting the logging.

a. Alert {{ insert: param, au-05_odp.01 }} within {{ insert: param, au-05_odp.02 }} in the event of an audit logging process failure; and b. Take the following additional actions: {{ insert: pa...

Provide a warning to {{ insert: param, au-05.01_odp.01 }} within {{ insert: param, au-05.01_odp.02 }} when allocated audit log storage volume reaches {{ insert: param, au-05.01_odp.03 }} of reposit...

Provide an alert within {{ insert: param, au-05.02_odp.01 }} to {{ insert: param, au-05.02_odp.02 }} when the following audit failure events occur: {{ insert: param, au-05.02_odp.03 }}.

Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and {{ insert: param, au-05.03_odp }} network traffic above those thresholds.

Invoke a {{ insert: param, au-05.04_odp.01 }} in the event of {{ insert: param, au-05.04_odp.02 }} , unless an alternate audit logging capability exists.

Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements {{ insert: param, au-05.05_odp }}.

a. Review and analyze system audit records {{ insert: param, au-06_odp.01 }} for indications of {{ insert: param, au-06_odp.02 }} and the potential impact of the inappropriate or unusual activity...

Integrate audit record review, analysis, and reporting processes using {{ insert: param, au-06.01_odp }}.

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

Integrate analysis of audit records with analysis of {{ insert: param, au-06.05_odp.01 }} to further enhance the ability to identify inappropriate or unusual activity.

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activ...

Specify the permitted actions for each {{ insert: param, au-06.07_odp }} associated with the review, analysis, and reporting of audit record information.

Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.

Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.

Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investiga...

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: {{ insert: param, au-07.01_odp }}.

a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet {{ insert: param, au-08_odp }} and that use Coordinated Universal ...

a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert {{ insert: param, au-09_odp }} upon detection of unauthorized access, mod...

Write audit trails to hardware-enforced, write-once media.

Store audit records {{ insert: param, au-09.02_odp }} in a repository that is part of a physically different system or system component than the system or component being audited.

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Authorize access to management of audit logging functionality to only {{ insert: param, au-09.04_odp }}.

Enforce dual authorization for {{ insert: param, au-09.05_odp.01 }} of {{ insert: param, au-09.05_odp.02 }}.

Authorize read-only access to audit information to {{ insert: param, au-09.06_odp }}.

Store audit information on a component running a different operating system than the system or component being audited.

Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed {{ insert: param, au-10_odp }}.

(a) Bind the identity of the information producer with the information to {{ insert: param, au-10.01_odp }} ; and (b) Provide the means for authorized individuals to determine the identity of t...

(a) Validate the binding of the information producer identity to the information at {{ insert: param, au-10.02_odp.01 }} ; and (b) Perform {{ insert: param, au-10.02_odp.02 }} in the event of a...

Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.

(a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between {{ insert: param, au-10.04_odp.01 }} ; and ...

Retain audit records for {{ insert: param, au-11_odp }} to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Employ {{ insert: param, au-11.01_odp }} to ensure that long-term audit records generated by the system can be retrieved.

a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on {{ insert: param, au-12_odp.01 }}; b. Allow {{ insert: ...

Compile audit records from {{ insert: param, au-12.01_odp.01 }} into a system-wide (logical or physical) audit trail that is time-correlated to within {{ insert: param, au-12.01_odp.02 }}.

Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.

Provide and implement the capability for {{ insert: param, au-12.03_odp.01 }} to change the logging to be performed on {{ insert: param, au-12.03_odp.02 }} based on {{ insert: param, au-12.03_odp.0...

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.

a. Monitor {{ insert: param, au-13_odp.01 }} {{ insert: param, au-13_odp.02 }} for evidence of unauthorized disclosure of organizational information; and b. If an information disclosure is disc...

Monitor open-source information and information sites using {{ insert: param, au-13.01_odp }}.

Review the list of open-source information sites being monitored {{ insert: param, au-13.02_odp }}.

Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.

a. Provide and implement the capability for {{ insert: param, au-14_odp.01 }} to {{ insert: param, au-14_odp.02 }} the content of a user session under {{ insert: param, au-14_odp.03 }} ; and b....

Initiate session audits automatically at system start-up.

Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.

Employ {{ insert: param, au-16_odp.01 }} for coordinating {{ insert: param, au-16_odp.02 }} among external organizations when audit information is transmitted across organizational boundaries.

Preserve the identity of individuals in cross-organizational audit trails.

Provide cross-organizational audit information to {{ insert: param, au-16.02_odp.01 }} based on {{ insert: param, au-16.02_odp.02 }}.

Implement {{ insert: param, au-16.03_odp }} to disassociate individuals from audit information transmitted across organizational boundaries.