CCI-001485

The organization defines the events which are to be audited on the information system on an organization-defined frequency of (or situation requiring) auditing for each identified event.

Implementation Guidance

The organization being inspected/assessed defines and documents events which are to be audited on the information system. Events should be selected from the events the information system is capable of auditing as defined in AU-2 (a) and should be based on ongoing risk assessments of current threat information and environment. DoD has determined that the events are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented list of events which are to be audited on the information system to ensure those events have been defined. DoD has determined that the events are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated audit and accountability policy and/or procedures

The controls below (if any) were marked by NIST as being related to CCI-001485.