CCI-001911

The organization defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined information system components, by organization-defined individuals or roles, within organization-defined time thresholds.

Implementation Guidance

The organization being inspected/assessed defines and documents the selectable event criteria for which changed auditing is to be performed. DoD has determined the selectable event criteria is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented selectable event criteria to ensure the organization being inspected/assessed defines the selectable event criteria for which changed auditing is to be performed. DoD has determined the selectable event criteria is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated audit and accountability policy, referencing section pertaining to selectable event criteria to be used as the basis for changes to the auditing 2.) Applicable STIG/SRG checks

The controls below (if any) were marked by NIST as being related to CCI-001911.