CCI-001885

The organization defines the audit fields within audit records to be searched for events of interest by the information system.

Implementation Guidance

The organization being inspected/assessed must define and document the audit fields within audit records to be searched for events of interest by the information system. DoD has determined that the audit fields are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented audit fields to ensure the organization being inspected/assessed defines the audit fields within audit records to be searched for events of interest by the information system. DoD has determined that the audit fields are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated audit and accountability policy 2.) Example of audit log report based on events of interest

The controls below (if any) were marked by NIST as being related to CCI-001885.