Navigate

AU-9(2)

AU-9(2): Audit Backup On Separate Physical Systems / Components

The information system backs up audit records [one of ] onto a physically different system or system component than the system or component being audited.

Supplemental

This control enhancement helps to ensure that a compromise of the information system being audited does not also result in a compromise of the audit records.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	high

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-9(2).

Control	Description
AU-4	The organization allocates audit record storage capacity in accordance with [one of ].
AU-5	The information system: a: Alerts [one of ] in the event of an audit processing failure; and b: Takes the following additional actions: [one of ].
AU-11	The organization retains audit records for [one of ] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Enhancements

The controls below (if any) add on to the requirements of AU-9(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-9(2).

CCI	Definition
CCI-001348	Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited.
CCI-001349	Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited.
CCI-001575	The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.