Navigate

AU-9(7)

AU-9(7): Store on Component with Different Operating System

Store audit information on a component running a different operating system than the system or component being audited.

Supplemental

Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AU-9(7).

Control	Description
AU-4	Allocate audit log storage capacity to accommodate [audit log retention requirements are defined;].
AU-5	a: Alert [personnel or roles receiving audit logging process failure alerts are defined;] within [time period for personnel or roles receiving audit logging process failure alerts is defined;] in the event of an audit logging process failure; and b: Take the following additional actions: [additional actions to be taken in the event of an audit logging process failure are defined;].
AU-11	Retain audit records for [a time period to retain audit records that is consistent with the records retention policy is defined;] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
SC-29	Employ a diverse set of information technologies for the following system components in the implementation of the system: [system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined;].

Enhancements

The controls below (if any) add on to the requirements of AU-9(7).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AU-9(7).

CCI	Definition
CCI-003833	Store audit information on a component running a different operating system than the system component being audited.