CCI-001881

Provide an audit reduction capability that does not alter original content or time ordering of audit records.

Implementation Guidance

The organization being inspected/assessed must ensure that the audit reduction capability does not alter the original audit records. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1881.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure that the organization being inspected/assessed employs an audit reduction capability that does not alter original audit records. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1881.

Compelling Evidence

1.) Example of audit log before and after audit reduction capability

The controls below (if any) were marked by NIST as being related to CCI-001881.