CCI-001867

Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to integrate the analysis of audit records with the data/information defined in AU-6 (5), CCI 1866 (if any) to further enhance its ability to identify inappropriate or unusual activity.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed integrates the analysis of audit records with the data/information defined in AU-6 (5), CCI 1866 (if any) to further enhance its ability to identify inappropriate or unusual activity.

Compelling Evidence

1.) Signed and dated audit and accountability policy and/or procedures that show a process for integrating analysis of audit records and scanning information. 2.) Audit records showing that this integration is occurring.

The controls below (if any) were marked by NIST as being related to CCI-001867.