03.03.01 Event logging
Choosing which event types the system logs and reviewing that selection at a defined frequency: the logging decisions that audit record content (03.03.02) and generation (03.03.03) then implement.
03.03 Audit and accountability
Rev. 3 audit and accountability requirements: which events to log, what audit records contain, generating and retaining them, responding to logging failures, review and correlation, reduction tools, time stamps and protecting audit data.
03.03.02 Audit record content
Making each audit record capture what happened, when, where, the source, the outcome and the identities involved, plus additional information as needed.
03.03.03 Audit record generation
Generating audit records for the event types and content selected under 03.03.01 and 03.03.02, and retaining them as long as the records retention policy requires.
03.03.04 Response to audit logging process failures
Alerting designated personnel or roles within a defined time when an audit logging process fails, for example through errors or full log storage, and taking further organization-defined actions.
03.03.05 Audit record review, analysis, and reporting
Reviewing and analyzing audit records at a defined frequency for signs of inappropriate or unusual activity, reporting findings, and correlating records across repositories for organization-wide awareness.
03.03.06 Audit record reduction and report generation
Tools to search, filter and summarize audit records for review, reporting and after-the-fact incident investigation, while preserving the original content and time order of the records.
03.03.07 Time stamps
Using internal system clocks to time-stamp audit records at a defined granularity, in UTC or with a fixed or recorded offset from UTC, so events can be correlated across systems.
03.03.08 Protection of audit information
Protecting audit logs and logging tools from unauthorized access, modification and deletion, and limiting management of logging to a subset of privileged users. Rev. 3 folded Rev. 2's 3.3.9 into it.
