Navigate

AU-6

AU-6: Audit Review, Analysis, and Reporting

The organization:

a: Reviews and analyzes information system audit records [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity]; and

b: Reports findings to [organization-defined personnel or roles].

Supplemental

Audit review, analysis, and reporting covers information security-related auditing performed by organizations including, for example, auditing that results from monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of VoIP. Findings can be reported to organizational entities that include, for example, incident response team, help desk, information security group/department. If organizations are prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), the review/analysis may be carried out by other organizations granted such authority.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C, Privacy (High), Privacy (Mod), Privacy (PHI)

CSF Categories
DE.AE-2, DE.AE-3, DE.DP-4, ID.SC-4, PR.PT-1, RS.AN-1, RS.CO-2

Related Controls

The controls below (if any) were marked by NIST as being related to AU-6.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AU-7	The information system provides an audit reduction and report generation capability that: a: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b: Does not alter the original content or time ordering of audit records.
AU-16	The organization employs [organization-defined methods] for coordinating [organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
CM-5	The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
CM-10	The organization: a: Uses software and associated documentation in accordance with contract agreements and copyright laws; b: Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c: Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
CM-11	The organization: a: Establishes [organization-defined policies] governing the installation of software by users; b: Enforces software installation policies through [organization-defined methods]; and c: Monitors policy compliance at [organization-defined frequency].
IA-3	The information system uniquely identifies and authenticates [organization-defined specific and/or types of devices] before establishing a [one or more of local/remote/network] connection.
IA-5	The organization manages information system authenticators by: a: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; b: Establishing initial authenticator content for authenticators defined by the organization; c: Ensuring that authenticators have sufficient strength of mechanism for their intended use; d: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; e: Changing default content of authenticators prior to information system installation; f: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; g: Changing/refreshing authenticators [organization-defined time period by authenticator type]; h: Protecting authenticator content from unauthorized disclosure and modification; i: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and j: Changing authenticators for group/role accounts when membership to those accounts changes.
IR-5	The organization tracks and documents information system security incidents.
IR-6	The organization: a: Requires personnel to report suspected security incidents to the organizational incident response capability within [organization-defined time period]; and b: Reports security incident information to [organization-defined authorities].
MA-4	The organization: a: Approves and monitors nonlocal maintenance and diagnostic activities; b: Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system; c: Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; d: Maintains records for nonlocal maintenance and diagnostic activities; and e: Terminates session and network connections when nonlocal maintenance is completed.
MP-4	The organization: a: Physically controls and securely stores [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-6	The organization: a: Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents; b: Reviews physical access logs [organization-defined frequency] and upon occurrence of [organization-defined events or potential indications of events]; and c: Coordinates results of reviews and investigations with the organizational incident response capability.
PE-14	The organization: a: Maintains temperature and humidity levels within the facility where the information system resides at [organization-defined acceptable levels]; and b: Monitors temperature and humidity levels [organization-defined frequency].
PE-16	The organization authorizes, monitors, and controls [organization-defined types of information system components] entering and exiting the facility and maintains records of those items.
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-18	The organization: a: Defines acceptable and unacceptable mobile code and mobile code technologies; b: Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and c: Authorizes, monitors, and controls the use of mobile code within the information system.
SC-19	The organization: a: Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and b: Authorizes, monitors, and controls the use of VoIP within the information system.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
SI-4	The organization: a: Monitors the information system to detect: 1: Attacks and indicators of potential attacks in accordance with [organization-defined monitoring objectives]; and 2: Unauthorized local, network, and remote connections; b: Identifies unauthorized use of the information system through [organization-defined techniques and methods]; c: Deploys monitoring devices: 1: Strategically within the information system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g: Provides [organization-defined information system monitoring information] to [organization-defined personnel or roles] [one or more of as needed/ {{ insert: param, si-4_prm_6 }} ].
SI-7	The organization employs integrity verification tools to detect unauthorized changes to [organization-defined software, firmware, and information].

Enhancements

The controls below (if any) add on to the requirements of AU-6.

Control	Description
AU-6(1)	The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
AU-6(2)
AU-6(3)	The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
AU-6(4)	The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
AU-6(5)	The organization integrates analysis of audit records with analysis of [one or more of vulnerability scanning information/performance data/information system monitoring information/ {{ insert: param, au-6.5_prm_2 }} ] to further enhance the ability to identify inappropriate or unusual activity.
AU-6(6)	The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
AU-6(7)	The organization specifies the permitted actions for each [one or more of information system process/role/user] associated with the review, analysis, and reporting of audit information.
AU-6(8)	The organization performs a full text analysis of audited privileged commands in a physically distinct component or subsystem of the information system, or other information system that is dedicated to that analysis.
AU-6(9)	The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.
AU-6(10)	The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Related CCIs

The CCIs below are tied to AU-6.

CCI	Definition
CCI-000148	Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.
CCI-000149	Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.
CCI-000151	Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.
CCI-001862	Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.
CCI-001863	Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.