CCI-001852

The organization defines the personnel, roles and/or locations to receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity.

Implementation Guidance

The organization being inspected/assessed defines and documents any personnel or roles, in addition to the ISSO/PMO and ISSM, who shall receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity. If there are no additional personnel or roles, the organization must also document that. DoD has defined the personnel or roles as at a minimum, the ISSO/PMO and ISSM.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles who should receive a warning when allocated audit record storage volume reaches a defined percentage of maximum audit records storage capacity to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles beyond the ISSO/PMO and ISSM. DoD has defined the personnel or roles as at a minimum, the ISSO/PMO and ISSM.

Compelling Evidence

1.) List of personnel who receive indications of organization-defined inappropriate or unusual activity

The controls below (if any) were marked by NIST as being related to CCI-001852.