AU-12 Audit Record Generation
Guidance: draftPolicy clause: draftWhat these mean
au12ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Low, Moderate, High | System | 4 (2 in a baseline) |
Related controls: AC-6, AC-17, AU-2, AU-3, AU-4, AU-5, AU-6, AU-7, AU-14, CM-5, MA-4, MP-4, PM-12, SA-8, SC-18, SI-3, SI-4, SI-7, SI-10
Control statement
Section titled “Control statement”- a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components];
- b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
- c. Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.
NIST discussion
Audit records can be generated from many different system components. The event types specified in AU-2d are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.
Control enhancements
Section titled “Control enhancements”AU-12(1) System-wide and Time-correlated Audit Trail
Section titled “AU-12(1) System-wide and Time-correlated Audit Trail”Baselines: High
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
Discussion and assessment objectives for AU-12(1)
Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.
Determine if audit records from [Assignment: organization-defined system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generation; system design documentation; system configuration settings and associated documentation; system-wide audit trail (logical or physical); system audit records; other relevant documents or records.
Interview: Organizational personnel with audit record generation responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.
Test: Mechanisms implementing audit record generation capability.
AU-12(2) Standardized Formats
Section titled “AU-12(2) Standardized Formats”Baselines: Not in a baseline
Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
Discussion and assessment objectives for AU-12(2)
Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails.
Determine if a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.
Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generation; system design documentation; system configuration settings and associated documentation; system-wide audit trail (logical or physical); system audit records; other relevant documents or records.
Interview: Organizational personnel with audit record generation responsibilities; organizational personnel with security responsibilities; system/network administrators; system developers.
Test: Mechanisms implementing audit record generation capability.
AU-12(3) Changes by Authorized Individuals
Section titled “AU-12(3) Changes by Authorized Individuals”Baselines: High
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].
Discussion and assessment objectives for AU-12(3)
Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).
Determine if:
- AU-12(03)[01] the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds] is provided;
- AU-12(03)[02] the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds] is implemented.
Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generation; system design documentation; system configuration settings and associated documentation; system-generated list of individuals or roles authorized to change auditing to be performed; system audit records; other relevant documents or records.
Interview: Organizational personnel with audit record generation responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.
Test: Mechanisms implementing audit record generation capability.
AU-12(4) Query Parameter Audits of Personally Identifiable Information
Section titled “AU-12(4) Query Parameter Audits of Personally Identifiable Information”Baselines: Not in a baseline
Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
Discussion and assessment objectives for AU-12(4)
Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.
Determine if:
- AU-12(04)[01] the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;
- AU-12(04)[02] the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.
Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generation; query event records; system design documentation; system configuration settings and associated documentation; map of system data actions; system audit records; other relevant documents or records.
Interview: Organizational personnel with audit record generation responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.
Test: Mechanisms implementing audit record generation capability.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for AU-12
Determine if:
- AU-12a. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignment: organization-defined system components];
- AU-12b. [Assignment: organization-defined personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
- AU-12c. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.
Examine: Audit and accountability policy; procedures addressing audit record generation; system security plan; privacy plan; system design documentation; system configuration settings and associated documentation; list of auditable events; system audit records; other relevant documents or records.
Interview: Organizational personnel with audit record generation responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.
Test: Mechanisms implementing audit record generation capability.
Policy statement
- The System owner shall ensure Fill in: system components that provide an audit record generation capability for the events types Typical: all servers, network devices, security tools, databases and applications in the system boundary provide an audit record generation capability for the event types identified under AU-2a. (AU-12a)
- The System owner shall allow only Fill in: personnel or roles allowed to select the event types that are to be logged by specific components of the system Typical: the system administrators, with the security operations team approving changes to select the event types logged by specific components of the system. (AU-12b)
- The System owner shall ensure the system generates audit records for the event types specified under AU-2c, with the content required by AU-3. (AU-12c)
AU-12(1) System-wide and time-correlated audit trail
- The System owner shall compile audit records from Fill in: system components from which audit records are to be compiled into a system-wide (logical or physical) audit trail Typical: all components that generate audit records into a system-wide audit trail that is time-correlated to within Fill in: level of tolerance for the relationship between timestamps of individual records in the audit trail Typical: one second. (AU-12(1))
AU-12(3) Changes by authorized individuals
- The System owner shall provide and implement the capability for Fill in: individuals or roles authorized to change the logging on system components Typical: the security operations administrators to change the logging performed on Fill in: system components on which logging is to be performed Typical: all components in the system boundary based on Fill in: selectable event criteria with which change logging is to be performed Typical: the event types in the audit logging standard, and additional detail for a user or component under investigation within Fill in: time thresholds in which logging actions are to change Typical: 1 hour. (AU-12(3))
From the Audit and Accountability Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”AU-12 is the technical side of AU-2: every component that should log does log the chosen events, with the content AU-3 requires, and only authorized people can change what is logged. Assessors test it by picking components and checking their logs contain the events the standard lists.
Common implementations. Logging enabled by configuration baseline on every server, network device, database and application, and forwarded to the central log platform. Changes to logging configuration limited to administrators and approved through change control (AU-12b). The audit logging standard template sets generation and collection in section 6, and a logging test with generated events in section 12; its Part B lists each component type and the events it logs.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Components that generate audit records (a) | All servers, network devices, security tools, databases and applications in the system boundary |
| Who may select logged events (b) | The system administrators, with the security operations team approving changes |
Evidence assessors ask for.
- Logging configuration from a sample of components
- Log entries for each required event type from those components
- The list of people who can change logging settings
Inheritance. Log forwarding agents and platform logging are often provided centrally; the system owns enabling logging on its components and applications.
Common findings.
- Components in the inventory that send no logs.
- Application logs missing user identity or outcome (AU-3).
- Anyone with administrator rights able to turn logging off unnoticed.
Enhancements in the Moderate baseline. None beyond the base control. High adds AU-12(1) a system-wide, time-correlated audit trail and AU-12(3) changes by authorized individuals.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.