AU-1 Policy and procedures
Audit and accountability policy and procedures: documenting, distributing, owning and periodically reviewing the policy and procedures behind logging and audit controls, and what assessors examine.
AU Audit and accountability
Audit and accountability (AU) family of NIST SP 800-53 Rev. 5: which events to log, audit record content, storage, failure response, review and analysis, time stamps, protection, retention and non-repudiation.
AU-2 Event logging
Choosing which event types to log: identifying what the system can log, coordinating with other parties that need audit data, selecting the subset to log, justifying that selection for investigations and reviewing it periodically.
AU-3 Content of audit records
What each audit record must contain: event type, time, location, source, outcome and the identities involved, plus enhancements for additional audit information and limiting personally identifiable information in records.
AU-4 Audit log storage capacity
Allocating enough audit log storage capacity to meet log retention requirements, so capacity is not exceeded and audit data lost, with an enhancement for transferring logs to alternate storage.
AU-5 Response to audit logging process failures
Responding when audit logging fails: alerting defined personnel within a set time and taking defined actions, plus high baseline enhancements for storage capacity warnings and real-time alerts.
AU-6 Audit record review, analysis, and reporting
Reviewing and analyzing audit records at a defined frequency for inappropriate or unusual activity, reporting findings and adjusting review when risk changes, plus enhancements for automated integration, correlation and central analysis.
AU-7 Audit record reduction and report generation
Providing audit record reduction and report generation that supports on-demand review and incident investigations without changing original record content or time order, plus the automatic processing enhancement.
AU-8 Time stamps
Generating audit record time stamps from internal system clocks at a defined granularity, expressed in UTC or with a fixed or recorded offset from UTC; both former clock synchronization enhancements are withdrawn.
AU-9 Protection of audit information
Protecting audit information and logging tools from unauthorized access, modification and deletion and alerting on such attempts, plus enhancements for separate storage, cryptographic protection and restricting log access to a subset of privileged users.
AU-10 Non-repudiation
Non-repudiation: irrefutable evidence that a person or process performed defined actions such as creating, sending or approving information; a high baseline control with enhancements on identity binding and chain of custody.
AU-11 Audit record retention
Retaining audit records for a defined period to support after-the-fact incident investigations and regulatory and organizational retention requirements, plus the long-term retrieval enhancement; also in the privacy baseline.
AU-12 Audit record generation
Generating audit records: providing logging capability on defined components for the AU-2 event types, letting defined roles choose what each component logs, and producing records with AU-3 content, plus system-wide time-correlated trails.
AU-13 Monitoring for information disclosure
Monitoring open-source information and sites, such as social networks and code repositories, for evidence of unauthorized disclosure of organizational information, and acting on what is found; not in any SP 800-53B baseline.
AU-14 Session audit
Session audit: the capability for defined roles to record, view, hear or log the content of user sessions in defined circumstances, developed with legal counsel; not in any SP 800-53B baseline.
AU-16 Cross-organizational audit logging
Coordinating audit information with external organizations when it crosses organizational boundaries, including preserving identities and sharing audit information; not in any SP 800-53B baseline.
