Navigate

CCI-000120

CCI-000120 Definition

Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented. - the audit and accountability procedures are disseminated to [AU-01_ODP[02]; personnel or roles to whom the audit and accountability procedures are to be disseminated is/are defined].

Validation Procedures

Examine: [SELECT FROM: Audit and accountability policy and procedures; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000120.

Control	Description
AU-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] audit and accountability policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls; b: Designate an [an official to manage the audit and accountability policy and procedures is defined;] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and c: Review and update the current audit and accountability: 1: Policy [the frequency at which the current audit and accountability policy is reviewed and updated is defined;] and following [events that would require the current audit and accountability policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current audit and accountability procedures are reviewed and updated is defined;] and following [events that would require audit and accountability procedures to be reviewed and updated are defined;].

Control

Description

AU-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] audit and accountability policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;

b: Designate an [an official to manage the audit and accountability policy and procedures is defined;] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and

c: Review and update the current audit and accountability:
- 1: Policy [the frequency at which the current audit and accountability policy is reviewed and updated is defined;] and following [events that would require the current audit and accountability policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current audit and accountability procedures are reviewed and updated is defined;] and following [events that would require audit and accountability procedures to be reviewed and updated are defined;].