Support the management of system accounts using organization-defined automated mechanisms.

Ensure that audit records containing information that establishes where the event occurred.

Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.

Provide the capability to centrally review and analyze audit records from multiple components within the system.

Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.

Use internal system clocks to generate time stamps for audit records.

Protect audit information from unauthorized access.

Protect audit information from unauthorized deletion.

Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.

Alert organization-defined personnel or roles of failed security verification tests.

Reveal error messages only to organization-defined personnel or roles.

Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.

Protect audit tools from unauthorized access.

Protect audit tools from unauthorized modification.

Protect audit tools from unauthorized deletion.

Allocate audit log storage capacity to accommodate organization-defined audit log retention requirements.

Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.

Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Provide an audit reduction capability that supports on-demand audit review and analysis.

Provide an audit reduction capability that supports on-demand reporting requirements.

Provide an audit reduction capability that supports after-the-fact investigations of incidents.

Provide a report generation capability that supports on-demand audit review and analysis.

Provide a report generation capability that supports on-demand reporting requirements.

Provide a report generation capability that supports after-the-fact investigations of security incidents.

Provide an audit reduction capability that does not alter original content or time ordering of audit records.

Provide a report generation capability that does not alter original content or time ordering of audit records.

Enforce dual authorization for movement and/or deletion of organization-defined audit information.

Implement the capability to centrally review and analyze audit records from multiple components within the system.

Implement an audit reduction capability that supports on-demand audit review and analysis.

Implement an audit reduction capability that supports on-demand reporting requirements.

Implement an audit reduction capability that supports after-the-fact investigations of incidents.

Implement a report generation capability that supports on-demand audit review and analysis.

Implement a report generation capability that supports on-demand reporting requirements.

Implement a report generation capability that supports after-the-fact investigations of incidents.

Implement an audit reduction capability that does not alter original content or time ordering of audit records.

Implement a report generation capability that does not alter original content or time ordering of audit records.

Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.

Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.

Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.

Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.

Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.

Automated System Account Management

Content of Audit Records

Audit Log Storage Capacity

Transfer to Alternate Storage

Response to Audit Logging Process Failures

Storage Capacity Warning

Real-time Alerts

Central Review and Analysis

Audit Record Reduction and Report Generation

Automatic Processing

Time Stamps

Protection of Audit Information

Store on Separate Physical Systems or Components

Dual Authorization

Audit Record Generation

System-wide and Time-correlated Audit Trail

Changes by Authorized Individuals

Security and Privacy Function Verification

Software, Firmware, and Information Integrity

Error Handling