Navigate

AU-12 (1)

AU-12 (1): System-Wide / Time-Correlated Audit Trail

The information system compiles audit records from [Assignment: organization-defined information system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail].

Supplemental

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-12 (1).

Control	Description
AU-8	The information system: AU-8a.: Uses internal system clocks to generate time stamps for audit records; and AU-8b.: Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined granularity of time measurement].
AU-12	The information system: AU-12a.: Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components]; AU-12b.: Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and AU-12c.: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Control

Description

AU-8

The information system:

AU-8a.: Uses internal system clocks to generate time stamps for audit records; and

AU-8b.: Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined granularity of time measurement].

AU-12

The information system:

AU-12a.: Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components];

AU-12b.: Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

AU-12c.: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Enhancements

The controls below (if any) add on to the requirements of AU-12 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-12 (1).

CCI	Definition
CCI-000173	The organization defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
CCI-000174	The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.
CCI-001576	The information system produces a system-wide (logical or physical) audit trail of information system audit records.
CCI-001577	The organization defines the information system components from which audit records are to be compiled into the system-wide audit trail.