CCI-001348

Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.

Implementation Guidance

The organization being inspected/assessed configures the information system to back up audit records at least every seven days. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1348. DoD has defined the frequency as every seven days.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed has configured the information system to back up audit records at least every seven days. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1348. DoD has defined the frequency as every seven days.

Compelling Evidence

1.) Signed and dated audit and accountability policy 2.) Example of information system backs up audit records at least weekly onto a different system or media than the system being audited.

The controls below (if any) were marked by NIST as being related to CCI-001348.