AU-6 (6)
AU-6 (6): Correlation With Physical Monitoring
The organization correlates information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Supplemental
The correlation of physical audit information and audit logs from information systems may assist organizations in identifying examples of suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual�s identity for logical access to certain information systems with the additional physical security information that the individual was actually present at the facility when the logical access occurred, may prove to be useful in investigations.
| CIA Levels | |
|---|---|
| Confidentiality | high |
| Integrity | high |
| Availability | unknown |
| Overlays |
|---|
| Int-A, Int-B, Int-C |