Navigate

AU-5 (2)

AU-5 (2): Real-Time Alerts

The information system provides an alert in [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit failure events requiring real-time alerts].

Supplemental

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less).

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	high

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to AU-5 (2).

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of AU-5 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-5 (2).

CCI	Definition
CCI-000147	The organization defines the audit failure events requiring real-time alerts.
CCI-001856	The organization defines the real-time period within which the information system is to provide an alert when organization-defined audit failure events occur.
CCI-001857	The organization defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.
CCI-001858	The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.