AU-4 Audit Log Storage Capacity

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	1 (0 in a baseline)

Related controls: AU-2, AU-5, AU-6, AU-7, AU-9, AU-11, AU-12, AU-14, SI-4

Control statement

Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].

NIST discussion

Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.

Control enhancements

AU-4(1) Transfer to Alternate Storage

Baselines: Not in a baseline

Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.

Discussion and assessment objectives for AU-4(1)

Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to AU-9(2) in that audit logs are transferred to a different entity. However, the purpose of selecting AU-9(2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.

Determine if audit logs are transferred [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.

Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit storage capacity; procedures addressing transfer of system audit records to secondary or alternate systems; system design documentation; system configuration settings and associated documentation; logs of audit record transfers to secondary or alternate systems; system audit records transferred to secondary or alternate systems; other relevant documents or records.

Interview: Organizational personnel with audit storage capacity planning responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms supporting the transfer of audit records onto a different system.

Assessment objectives (SP 800-53A)

Objectives and methods for AU-4

Determine if audit log storage capacity is allocated to accommodate [Assignment: organization-defined audit log retention requirements].

Examine: Audit and accountability policy; procedures addressing audit storage capacity; system security plan; privacy plan; system design documentation; system configuration settings and associated documentation; audit record storage requirements; audit record storage capability for system components; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Audit record storage capacity and related configuration settings.

Policy statement

• The System owner shall allocate audit log storage capacity to accommodate Fill in: audit log retention requirements Typical: the retention period set under AU-11, with room for a year of growth. (AU-4)

From the Audit and Accountability Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AU-4 asks you to allocate enough storage to keep audit logs for as long as your retention requirements say. NIST’s AU-4 discussion notes that enough capacity reduces the chance of running out and losing logging. Size the storage from the log volume you actually collect and the retention period set under AU-11.

Common implementations. A central log platform sized from measured daily ingest multiplied by the retention period, plus growth. Storage split into tiers: recent logs in a searchable tier and older logs in cheaper archive storage, such as cloud object storage. Local buffers on each component big enough to hold logs through a forwarding outage, so nothing is overwritten before it reaches the platform. Capacity reviewed when a system adds components or log sources.

Organization-defined parameters. Typical value, which your organization may set differently:

Parameter	Typical value
Audit log retention requirements (AU-4)	The retention period set under AU-11, with room for a year of growth

In the Audit and Accountability policy, the system owner allocates the capacity. Where the system’s logs go to a central platform, that means agreeing the capacity with the platform’s owner and reporting each new log source.

Evidence assessors ask for.

• The capacity calculation or plan: daily ingest, retention period and growth allowance
• Current storage use against capacity on the log platform
• Retention settings on the platform, and local log size and rotation settings on a sample of components
• Records of the last capacity review

Inheritance. A central log platform’s capacity is usually a common control. The system owns local log storage on its components and telling the platform’s owner about new sources, so AU-4 is often a hybrid control.

Common findings.

• Small local log files that rotate and overwrite events before they are forwarded.
• A retention period set shorter than AU-11 requires because the platform ran out of space.
• A licensed ingest limit that drops events once exceeded, with no alert.
• No capacity review after a large new log source, such as a cloud service, was added.

Enhancements in the Moderate baseline. None. AU-4(1) transfer to alternate storage is in no baseline. In High, AU-5(1) adds a warning before storage runs out.

Artifacts

• Audit and Accountability Decision Worksheet
• Audit and Accountability Policy
• Audit Logging Standard