CyberStrikeus/CyberStrike - Page 120

au-16-2-sharing-of-audit-information

Provide cross-organizational audit information to [organization-defined] based on [organization-defined].

au-16-3-disassociability

Implement [organization-defined] to disassociate individuals from audit information transmitted across organizational boundaries.

au-16-cross-organizational-audit-logging

Employ [organization-defined] for coordinating [organization-defined] among external organizations when audit information is transmitted across organi

au-2-1-compilation-of-audit-records-from-multiple-sources

Compilation of Audit Records from Multiple Sources

au-2-2-selection-of-audit-events-by-component

Selection of Audit Events by Component

au-2-3-reviews-and-updates

Reviews and Updates

au-2-4-privileged-functions

Privileged Functions

au-2-event-logging

Identify the types of events that the system is capable of logging in support of the audit function: [organization-defined];

au-3-1-additional-audit-information

Generate audit records containing the following additional information: [organization-defined].

au-3-2-centralized-management-of-planned-audit-record-content

Centralized Management of Planned Audit Record Content

au-3-3-limit-personally-identifiable-information-elements

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [organizatio

au-3-content-of-audit-records

Ensure that audit records contain information that establishes the following: What type of event occurred; When the event occurred; Where the event oc

au-4-1-transfer-to-alternate-storage

Transfer audit logs [organization-defined] to a different system, system component, or media other than the system or system component conducting the

au-4-audit-log-storage-capacity

Allocate audit log storage capacity to accommodate [organization-defined].

au-5-1-storage-capacity-warning

Provide a warning to [organization-defined] within [organization-defined] when allocated audit log storage volume reaches [organization-defined] of re

au-5-2-real-time-alerts

Provide an alert within [organization-defined] to [organization-defined] when the following audit failure events occur: [organization-defined].

au-5-3-configurable-traffic-volume-thresholds

Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [organization-defined] netwo

au-5-4-shutdown-on-failure

Invoke a [organization-defined] in the event of [organization-defined] , unless an alternate audit logging capability exists.

au-5-5-alternate-audit-logging-capability

Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [organization-defined].

au-5-response-to-audit-logging-process-failures

Alert [organization-defined] within [organization-defined] in the event of an audit logging process failure;

au-6-1-automated-process-integration

Integrate audit record review, analysis, and reporting processes using [organization-defined].

au-6-10-audit-level-adjustment

Audit Level Adjustment

au-6-2-automated-security-alerts

Automated Security Alerts

au-6-3-correlate-audit-record-repositories

Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

au-6-4-central-review-and-analysis

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

au-6-5-integrated-analysis-of-audit-records

Integrate analysis of audit records with analysis of [organization-defined] to further enhance the ability to identify inappropriate or unusual activi

au-6-6-correlation-with-physical-monitoring

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicio

au-6-7-permitted-actions

Specify the permitted actions for each [organization-defined] associated with the review, analysis, and reporting of audit record information.

au-6-8-full-text-analysis-of-privileged-commands

Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedi

au-6-9-correlation-with-information-from-nontechnical-sources

Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.

au-6-audit-record-review-analysis-and-reporting

Review and analyze system audit records [organization-defined] for indications of [organization-defined] and the potential impact of the inappropri...

au-7-1-automatic-processing

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [organization-d

au-7-2-automatic-sort-and-search

Automatic Sort and Search

au-7-audit-record-reduction-and-report-generation

Provide and implement an audit record reduction and report generation capability that: Supports on-demand audit record review, analysis, and reporting

au-8-1-synchronization-with-authoritative-time-source

Synchronization with Authoritative Time Source

au-8-2-secondary-authoritative-time-source

Secondary Authoritative Time Source

au-8-time-stamps

Use internal system clocks to generate time stamps for audit records;

au-9-1-hardware-write-once-media

Write audit trails to hardware-enforced, write-once media.

au-9-2-store-on-separate-physical-systems-or-components

Store audit records [organization-defined] in a repository that is part of a physically different system or system component than the system or compon

au-9-3-cryptographic-protection

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.