Navigate

AU-12(1)

AU-12(1): System-wide / Time-correlated Audit Trail

The information system compiles audit records from [one of ] into a system-wide (logical or physical) audit trail that is time-correlated to within [one of ].

Supplemental

Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-12(1).

Control	Description
AU-8	The information system: a: Uses internal system clocks to generate time stamps for audit records; and b: Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [one of ].
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [one of ]; b: Allows [one of ] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Enhancements

The controls below (if any) add on to the requirements of AU-12(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-12(1).

CCI	Definition
CCI-000173	Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
CCI-000174	Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail.
CCI-001576	The information system produces a system-wide (logical or physical) audit trail of information system audit records.
CCI-001577	Defines the system components from which audit records are to be compiled into the system-wide audit trail.