CCI-001921

The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.

Implementation Guidance

The organization being inspected/assessed will define and document the alternative audit functionality to be provided in the event of a failure in the primary audit capability. The organization shall consider trade-offs between the needs for system availability and audit integrity when defining the actions. Unless availability is an overriding concern, the default action should be to shut down the information system. DoD has determined that the actions are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented alternative audit functionality to ensure the organization being inspected/assessed has defined the alternative audit functionality to be provided in the event of a failure in the primary audit capability. DoD has determined that the actions are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated audit and accountability policy

The controls below (if any) were marked by NIST as being related to CCI-001921.