Navigate

AU-9 (2)

AU-9 (2): Audit Backup On Separate Physical Systems / Components

The information system backs up audit records [Assignment: organization-defined frequency] onto a physically different system or system component than the system or component being audited.

Supplemental

This control enhancement helps to ensure that a compromise of the information system being audited does not also result in a compromise of the audit records.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	high

Overlays
Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer)

Related Controls

The controls below (if any) were marked by NIST as being related to AU-9 (2).

Control	Description
AU-4	The organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements].
AU-5	The information system: AU-5a.: Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure; and AU-5b.: Takes the following additional actions: [Assignment: organization-defined actions to be taken (e.g., shut down information system, overwrite oldest audit records, stop generating audit records)].
AU-11	The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Enhancements

The controls below (if any) add on to the requirements of AU-9 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-9 (2).

CCI	Definition
CCI-001348	The information system backs up audit records on an organization-defined frequency onto a different system or system component than the system or component being audited.
CCI-001349	The organization defines a frequency for backing up system audit records onto a different system or system component than the system or component being audited.
CCI-001575	The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.