Navigate

SI-7(8)

SI-7(8): Auditing Capability for Significant Events

The information system, upon detection of a potential integrity violation, provides the capability to audit the event and initiates the following actions: [one or more of "generates an audit record"/"alerts current user"/"alerts {{ insert: param, si-7.8_prm_2 }} "/" {{ insert: param, si-7.8_prm_3 }} "].

Supplemental

Organizations select response actions based on types of software, specific software, or information for which there are potential integrity violations.

CIA Levels
Confidentiality	unknown
Integrity	moderate
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SI-7(8).

Control	Description
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [one of ]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [one of ].
AU-6	The organization: a: Reviews and analyzes information system audit records [one of ] for indications of [one of ]; and b: Reports findings to [one of ].
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [one of ]; b: Allows [one of ] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Enhancements

The controls below (if any) add on to the requirements of SI-7(8).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SI-7(8).

CCI	Definition
CCI-002721	Defines the personnel or roles that are to be alerted when a potential integrity violation is detected.
CCI-002722	Defines other actions that can be taken when a potential integrity violation is detected.
CCI-002723	Upon detection of a potential integrity violation, provides the capability to audit the event.
CCI-002724	Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions.