Navigate

AU-6(3)

AU-6(3): Correlate Audit Repositories

The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

Supplemental

Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-6(3).

Control	Description
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [organization-defined information system components]; b: Allows [organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
IR-4	The organization: a: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinates incident handling activities with contingency planning activities; and c: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

Control

Description

AU-12

The information system:

a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [organization-defined information system components];

b: Allows [organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

IR-4

The organization:

a: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

b: Coordinates incident handling activities with contingency planning activities; and

c: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

Enhancements

The controls below (if any) add on to the requirements of AU-6(3).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-6(3).

CCI	Definition
CCI-000153	Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.