CCI-001912

Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria.

Implementation Guidance

The organization being inspected/assessed defines and documents the time thresholds for individuals or roles to change the auditing to be performed on information system components based on selectable event criteria defined in AU-12 (3), CCI 1911 occurs. DoD has determined the time thresholds are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented time thresholds to ensure the organization being inspected/assessed defines the time thresholds for individuals or roles to change the auditing to be performed on information system components based on selectable event criteria defined in AU-12 (3), CCI 1911 occurs. DoD has determined the time thresholds are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated audit and accountability policy, referencing section defining the time threshold for organizational-defined individuals or roles to change the auditing 2.) Applicable STIG/SRG checks

The controls below (if any) were marked by NIST as being related to CCI-001912.