Navigate

AU-15

AU-15: Alternate Audit Capability

The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides [Assignment: organization-defined alternate audit functionality].

Supplemental

Since an alternate audit capability may be a short-term protection employed until the failure in the primary auditing capability is corrected, organizations may determine that the alternate audit capability need only provide a subset of the primary audit functionality that is impacted by the failure.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-15.

Control	Description
AU-5	The information system: AU-5a.: Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure; and AU-5b.: Takes the following additional actions: [Assignment: organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].

Enhancements

The controls below (if any) add on to the requirements of AU-15.

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-15.

CCI	Definition
CCI-001921	The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.
CCI-001922	The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.