Navigate

AU-12

AU-12: Audit Generation

The information system:

a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [organization-defined information system components];

b: Allows [organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Supplemental

Audit records can be generated from many different information system components. The list of audited events is the set of events for which audits are to be generated. These events are typically a subset of all events for which the information system is capable of generating audit records.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C, Privacy (CNSSI 1253), Privacy (High), Privacy (Mod), Privacy (PHI)

CSF Categories
DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1

Related Controls

The controls below (if any) were marked by NIST as being related to AU-12.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-3	The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
AU-6	The organization: a: Reviews and analyzes information system audit records [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity]; and b: Reports findings to [organization-defined personnel or roles].
AU-7	The information system provides an audit reduction and report generation capability that: a: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b: Does not alter the original content or time ordering of audit records.

Enhancements

The controls below (if any) add on to the requirements of AU-12.

Control	Description
AU-12(1)	The information system compiles audit records from [organization-defined information system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail].
AU-12(2)	The information system produces a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
AU-12(3)	The information system provides the capability for [organization-defined individuals or roles] to change the auditing to be performed on [organization-defined information system components] based on [organization-defined selectable event criteria] within [organization-defined time thresholds].

Related CCIs

The CCIs below are tied to AU-12.

CCI	Definition
CCI-000169	Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components.
CCI-000171	Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
CCI-000172	Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
CCI-001459	Defines system components that provide audit record generation capability.
CCI-001910	Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system.