Audit and Accountability Policy

Audit and Accountability Policy template: Ready-to-adopt Audit and Accountability policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Audit and Accountability policy states what the organization requires for audit and accountability and who is accountable for it. It meets AU-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. AU-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
AU-1	Policy and Procedures	Yes	Yes	Yes	Yes
AU-2	Event Logging	Yes	Yes	Yes	Yes
AU-3	Content of Audit Records	Yes	Yes	Yes
AU-3(1)	Additional Audit Information		Yes	Yes
AU-3(3)	Limit Personally Identifiable Information Elements				Yes
AU-4	Audit Log Storage Capacity	Yes	Yes	Yes
AU-5	Response to Audit Logging Process Failures	Yes	Yes	Yes
AU-5(1)	Storage Capacity Warning			Yes
AU-5(2)	Real-time Alerts			Yes
AU-6	Audit Record Review, Analysis, and Reporting	Yes	Yes	Yes
AU-6(1)	Automated Process Integration		Yes	Yes
AU-6(3)	Correlate Audit Record Repositories		Yes	Yes
AU-6(5)	Integrated Analysis of Audit Records			Yes
AU-6(6)	Correlation with Physical Monitoring			Yes
AU-7	Audit Record Reduction and Report Generation		Yes	Yes
AU-7(1)	Automatic Processing		Yes	Yes
AU-8	Time Stamps	Yes	Yes	Yes
AU-9	Protection of Audit Information	Yes	Yes	Yes
AU-9(2)	Store on Separate Physical Systems or Components			Yes
AU-9(3)	Cryptographic Protection			Yes
AU-9(4)	Access by Subset of Privileged Users		Yes	Yes
AU-10	Non-repudiation			Yes
AU-11	Audit Record Retention	Yes	Yes	Yes	Yes
AU-12	Audit Record Generation	Yes	Yes	Yes
AU-12(1)	System-wide and Time-correlated Audit Trail			Yes
AU-12(3)	Changes by Authorized Individuals			Yes

Decisions to make first

The policy has 45 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Where are audit records collected, and who operates that platform?	AU-6(1), AU-9(2)	A central log platform or SIEM run by the security operations team, separate from the systems it collects from.	Chief Information Security Officer
Which event types does every system log as a minimum?	AU-2, AU-12	The list in the audit logging standard, reviewed annually.	Chief Information Security Officer

Record your values in the Audit and Accountability decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: AU pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet AU-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AU-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Audit and Accountability, and who is accountable for meeting those requirements. (AU-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AU-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (AU-1a.1(a))
• The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (AU-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (AU-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (AU-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (AU-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AU-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (AU-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (AU-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (AU-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (AU-1a.1(a))

Procedures

The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (AU-1a.2)

Dissemination

• The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the audit and accountability policy is to be disseminated Typical: everyone within its scope, through the policy library. (AU-1a)
• The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the audit and accountability procedures are to be disseminated Typical: the people who carry them out, and the system owners. (AU-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Event logging (AU-2)

Guidance

AU-2 asks for two lists: every event type the system can log, and the subset you actually log, with a reason the subset is enough to investigate an incident. Keep both in the audit logging standard so every system starts from the same list: section 3 holds the organization-wide list and Part B each system’s own. Assessors ask for the rationale (AU-2d) more often than any other item.

• The System owner shall identify Fill in: the event types that the system is capable of logging in support of the audit function Typical: logons and logoffs, account and privilege changes, use of privileged functions, access to security-relevant files, configuration changes, and security tool events as the event types the system is capable of logging in support of the audit function. (AU-2a)
• The Chief Information Security Officer shall coordinate the event logging function with the other organizational entities that need audit-related information, to inform which events are logged. (AU-2b)
• The System owner shall specify Fill in: event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type Typical: the event types listed in the audit logging standard, each logged whenever it occurs for logging within the system. (AU-2c)
• The System owner shall document why the event types selected for logging are adequate to support after-the-fact investigation of incidents. (AU-2d)
• The System owner shall review and update the event types selected for logging Fill in: the frequency of event types selected for logging are reviewed and updated Typical: annually and after a significant incident or system change. (AU-2e)

Content of audit records (AU-3)

• The System owner shall ensure audit records establish what type of event occurred, when and where it occurred, its source, its outcome, and the identity of any individuals, subjects or objects associated with it. (AU-3)

Additional audit information (AU-3(1))

• The System owner shall ensure the system generates audit records that also contain Fill in: additional information to be included in audit records Typical: session and request identifiers, source and destination addresses, and the full command line for privileged commands. (AU-3(1))

Audit log storage capacity (AU-4)

• The System owner shall allocate audit log storage capacity to accommodate Fill in: audit log retention requirements Typical: the retention period set under AU-11, with room for a year of growth. (AU-4)

Response to audit logging process failures (AU-5)

• The System owner shall ensure the system alerts Fill in: personnel or roles receiving audit logging process failure alerts Typical: the system administrators and the security operations team within Fill in: time period for personnel or roles receiving audit logging process failure alerts Typical: 1 hour of an audit logging process failure. (AU-5a)
• When an audit logging process fails, the System owner shall Fill in: additional actions to be taken in the event of an audit logging process failure Typical: restore logging and record the gap in the audit trail; for high-impact systems, stop processing that cannot be logged. (AU-5b)

Audit record review, analysis and reporting (AU-6)

Guidance

Most findings under AU-6 are about evidence, not effort: the review happened but left no record. Keep a dated record of each review with what was looked at, what was found and who it was reported to. The log review procedure lists the activity the review looks for in its section 3 and names the record each step leaves.

• The Security operations team shall review and analyze system audit records Fill in: frequency at which system audit records are reviewed and analyzed Typical: continuously through automated alerting, with a documented manual review at least weekly for indications of Fill in: inappropriate or unusual activity Typical: the activity listed in the log review procedure, such as repeated failed logons, privilege escalation and access outside normal patterns and its potential impact. (AU-6a)
• The Security operations team shall report findings to Fill in: personnel or roles to receive findings from reviews and analyses of system records Typical: the system owner and the incident response team. (AU-6b)
• The Security operations team shall adjust the level of audit record review, analysis and reporting when law enforcement information, intelligence information or other credible sources indicate a change in risk. (AU-6c)

Automated process integration (AU-6(1))

• The Security operations team shall integrate audit record review, analysis and reporting processes using Fill in: automated mechanisms used for integrating audit record review, analysis, and reporting processes Typical: a security information and event management (SIEM) platform. (AU-6(1))

Correlate audit record repositories (AU-6(3))

• The Security operations team shall analyze and correlate audit records across repositories to gain organization-wide situational awareness. (AU-6(3))

Audit record reduction and report generation (AU-7)

• The System owner shall provide and implement an audit record reduction and report generation capability that supports on-demand review, analysis and reporting and after-the-fact investigation of incidents. (AU-7a)
• The System owner shall ensure that capability does not alter the original content or time ordering of audit records. (AU-7b)

Automatic processing (AU-7(1))

• The System owner shall provide and implement the capability to process, sort and search audit records for events of interest based on Fill in: fields within audit records that can be processed, sorted, or searched Typical: event type, time, source and destination, user identity, outcome and system component. (AU-7(1))

Time stamps (AU-8)

• The System owner shall ensure the system uses internal system clocks to generate time stamps for audit records. (AU-8a)
• The System owner shall ensure audit record time stamps meet a granularity of Fill in: granularity of time measurement for audit record timestamps Typical: one second or finer and use Coordinated Universal Time, a fixed offset from it, or include the local offset in the time stamp. (AU-8b)

Protection of audit information (AU-9)

• The System owner shall protect audit information and audit logging tools from unauthorized access, modification and deletion. (AU-9a)
• The System owner shall ensure Fill in: personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information Typical: the security operations team and the system owner are alerted when unauthorized access, modification or deletion of audit information is detected. (AU-9b)

Access by subset of privileged users (AU-9(4))

• The System owner shall authorize access to management of audit logging functionality only for Fill in: a subset of privileged users or roles authorized to access management of audit logging functionality Typical: the security operations administrators, who do not administer the systems being audited. (AU-9(4))

Audit record retention (AU-11)

• The System owner shall retain audit records for Fill in: a time period to retain audit records that is consistent with the records retention policy Typical: at least one year, or longer where the records retention schedule or a law requires it to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)

Federal systems

OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. Its Appendix B requires retained logs to be actively searchable for at least 6 months after creation and retrievable for a year after creation, and notes that meeting these minimums does not relieve agencies of other requirements, such as those set by agency-specific or government-wide records schedules. It does not apply to national security systems. As of September 2026.

• The System owner shall keep audit records actively searchable for at least 6 months after creation, and retrievable for at least one year after creation, as OMB M-26-14 requires. (AU-11)

Audit record generation (AU-12)

• The System owner shall ensure Fill in: system components that provide an audit record generation capability for the events types Typical: all servers, network devices, security tools, databases and applications in the system boundary provide an audit record generation capability for the event types identified under AU-2a. (AU-12a)
• The System owner shall allow only Fill in: personnel or roles allowed to select the event types that are to be logged by specific components of the system Typical: the system administrators, with the security operations team approving changes to select the event types logged by specific components of the system. (AU-12b)
• The System owner shall ensure the system generates audit records for the event types specified under AU-2c, with the content required by AU-3. (AU-12c)

Review and update

• The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current audit and accountability policy is reviewed and updated Typical: annually and following Fill in: events that would require the current audit and accountability policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (AU-1c.1)
• The Fill in: an official to manage the audit and accountability policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current audit and accountability procedures are reviewed and updated Typical: annually and following Fill in: events that would require audit and accountability procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (AU-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AU-1a.1(b))