Navigate

AU-3

AU-3: Content Of Audit Records

The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

Supplemental

Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the information system after the event occurred).

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AU-3.

Control	Description
AU-2	The organization: AU-2a.: Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events]; AU-2b.: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; AU-2c.: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and AU-2d.: Determines that the following events are to be audited within the information system: [Assignment: organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-8	The information system: AU-8a.: Uses internal system clocks to generate time stamps for audit records; and AU-8b.: Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: organization-defined granularity of time measurement].
AU-12	The information system: AU-12a.: Provides audit record generation capability for the auditable events defined in AU-2 a. at [Assignment: organization-defined information system components]; AU-12b.: Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and AU-12c.: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
SI-11	The information system: SI-11a.: Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and SI-11b.: Reveals error messages only to [Assignment: organization-defined personnel or roles].

Enhancements

The controls below (if any) add on to the requirements of AU-3.

Control	Description
AU-3 (1)	The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].
AU-3 (2)	The information system provides centralized management and configuration of the content to be captured in audit records generated by [Assignment: organization-defined information system components].

Related CCIs

The CCIs below are tied to AU-3.

CCI	Definition
CCI-000130	The information system generates audit records containing information that establishes what type of event occurred.
CCI-000131	The information system generates audit records containing information that establishes when an event occurred.
CCI-000132	The information system generates audit records containing information that establishes where the event occurred.
CCI-000133	The information system generates audit records containing information that establishes the source of the event.
CCI-000134	The information system generates audit records containing information that establishes the outcome of the event.
CCI-001487	The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.