Navigate

AU-9

AU-9: Protection Of Audit Information

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

Supplemental

Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. This control focuses on technical protection of audit information. Physical protection of audit information is addressed by media protection controls and physical and environmental protection controls.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AU-9.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
MP-2	The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
MP-4	The organization: MP-4a.: Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and MP-4b.: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
PE-2	The organization: PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; PE-2b.: Issues authorization credentials for facility access; PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and PE-2d.: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-6	The organization: PE-6a.: Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents; PE-6b.: Reviews physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and PE-6c.: Coordinates results of reviews and investigations with the organizational incident response capability.

Enhancements

The controls below (if any) add on to the requirements of AU-9.

Control	Description
AU-9 (1)	The information system writes audit trails to hardware-enforced, write-once media.
AU-9 (2)	The information system backs up audit records [Assignment: organization-defined frequency] onto a physically different system or system component than the system or component being audited.
AU-9 (3)	The information system implements cryptographic mechanisms to protect the integrity of audit information and audit tools.
AU-9 (4)	The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users].
AU-9 (5)	The organization enforces dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].
AU-9 (6)	The organization authorizes read-only access to audit information to [Assignment: organization-defined subset of privileged users].

Related CCIs

The CCIs below are tied to AU-9.

CCI	Definition
CCI-000162	The information system protects audit information from unauthorized access.
CCI-000163	The information system protects audit information from unauthorized modification.
CCI-000164	The information system protects audit information from unauthorized deletion.
CCI-001493	The information system protects audit tools from unauthorized access.
CCI-001494	The information system protects audit tools from unauthorized modification.
CCI-001495	The information system protects audit tools from unauthorized deletion.