Navigate

AU-15

AU-15: Alternate Audit Capability

The organization provides an alternate audit capability in the event of a failure in primary audit capability that provides [organization-defined alternate audit functionality].

Supplemental

Since an alternate audit capability may be a short-term protection employed until the failure in the primary auditing capability is corrected, organizations may determine that the alternate audit capability need only provide a subset of the primary audit functionality that is impacted by the failure.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
PR.PT-1

Related Controls

The controls below (if any) were marked by NIST as being related to AU-15.

Control	Description
AU-5	The information system: a: Alerts [organization-defined personnel or roles] in the event of an audit processing failure; and b: Takes the following additional actions: [organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].

Enhancements

The controls below (if any) add on to the requirements of AU-15.

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-15.

CCI	Definition
CCI-001921	The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.
CCI-001922	The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.