# Audit and Accountability Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/au/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Audit and Accountability, and who is accountable for meeting those requirements. (AU-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AU-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AU-1a.1(a))
- The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AU-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AU-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AU-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AU-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AU-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AU-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AU-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AU-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AU-1a.1(a))

## Procedures

The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AU-1a.2)

## Dissemination

- The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the audit and accountability policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AU-1a)
- The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the audit and accountability procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AU-1a)

## Policy statements

### Event logging (AU-2)

- The [System owner] shall identify [Fill in: the event types that the system is capable of logging in support of the audit function. Typical: logons and logoffs, account and privilege changes, use of privileged functions, access to security-relevant files, configuration changes, and security tool events] as the event types the system is capable of logging in support of the audit function. (AU-2a)
- The [Chief Information Security Officer] shall coordinate the event logging function with the other organizational entities that need audit-related information, to inform which events are logged. (AU-2b)
- The [System owner] shall specify [Fill in: event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type. Typical: the event types listed in the audit logging standard, each logged whenever it occurs] for logging within the system. (AU-2c)
- The [System owner] shall document why the event types selected for logging are adequate to support after-the-fact investigation of incidents. (AU-2d)
- The [System owner] shall review and update the event types selected for logging [Fill in: the frequency of event types selected for logging are reviewed and updated. Typical: annually and after a significant incident or system change]. (AU-2e)

### Limit personally identifiable information elements (AU-3(3))

- For a system that processes personally identifiable information, the [System owner] shall limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Fill in: elements identified in the privacy risk assessment. Typical: the account identifier, the source address and device, and the identifiers of records accessed, not their contents]. (AU-3(3))
- The [Senior privacy official] shall review, with the [System owner], the personally identifiable information elements the system writes to audit records, and the [System owner] shall record the approved elements in the privacy impact assessment. (AU-3(3))
- The [System owner] shall ensure request bodies, form inputs, query strings and other content that may hold personally identifiable information are masked, truncated or left out of audit records unless the privacy impact assessment lists them as needed. (AU-3(3))

### Audit record retention (AU-11)

- The [System owner] shall retain audit records for [Fill in: a time period to retain audit records that is consistent with the records retention policy. Typical: at least one year, or longer where the records retention schedule or a law requires it] to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)

#### Federal systems

[OMB M-26-14](https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf), Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. Its Appendix B requires retained logs to be actively searchable for at least 6 months after creation and retrievable for a year after creation, and notes that meeting these minimums does not relieve agencies of other requirements, such as those set by agency-specific or government-wide records schedules. It does not apply to national security systems. As of September 2026.

- The [System owner] shall keep audit records actively searchable for at least 6 months after creation, and retrievable for at least one year after creation, as OMB M-26-14 requires. (AU-11)

## Review and update

- The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current audit and accountability policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current audit and accountability policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AU-1c.1)
- The [Fill in: an official to manage the audit and accountability policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current audit and accountability procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require audit and accountability procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AU-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AU-1a.1(b))