Navigate

AU-14

AU-14: Session Audit

The information system provides the capability for authorized users to select a user session to capture/record or view/hear.

Supplemental

Session audits include, for example, monitoring keystrokes, tracking websites visited, and recording information and/or file transfers. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, or standards.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C

CSF Categories
PR.PT-1

Related Controls

The controls below (if any) were marked by NIST as being related to AU-14.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AU-4	The organization allocates audit record storage capacity in accordance with [organization-defined audit record storage requirements].
AU-5	The information system: a: Alerts [organization-defined personnel or roles] in the event of an audit processing failure; and b: Takes the following additional actions: [organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].
AU-9	The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
AU-11	The organization retains audit records for [organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Enhancements

The controls below (if any) add on to the requirements of AU-14.

Control	Description
AU-14(1)	The information system initiates session audits at system start-up.
AU-14(2)	The information system provides the capability for authorized users to capture/record and log content related to a user session.
AU-14(3)	The information system provides the capability for authorized users to remotely view/hear all content related to an established user session in real time.

Related CCIs

The CCIs below are tied to AU-14.

CCI	Definition
CCI-001919	Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances.