Audit and Accountability Decision Worksheet
Audit and Accountability Decision Worksheet template: Every decision the Audit and Accountability family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.
| Type | Program stage | Status | Template version | NIST basis |
|---|---|---|---|---|
| Decision worksheet | Core | Draft | 1.0.0 | SP 800-53 release 5.2.0 |
What it is
Section titled “What it is”Every decision the Audit and Accountability family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every AU control in the baseline, with a typical value where the Audit and Accountability Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.
Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.
Downloads
Section titled “Downloads”| Variant | Spreadsheet |
|---|---|
| Low | CSV |
| Moderate | CSV |
| High | CSV |
| Privacy | CSV |
Decisions (Moderate baseline)
Section titled “Decisions (Moderate baseline)”30 decisions.
| Decision | Control | Typical value | Who decides |
|---|---|---|---|
| Where are audit records collected, and who operates that platform? | AU-6(1), AU-9(2) | A central log platform or SIEM run by the security operations team, separate from the systems it collects from. | Chief Information Security Officer |
| Which event types does every system log as a minimum? | AU-2, AU-12 | The list in the audit logging standard, reviewed annually. | Chief Information Security Officer |
| Personnel or roles to whom the audit and accountability policy is to be disseminated | AU-1 | Everyone within its scope, through the policy library | Chief Information Security Officer |
| Personnel or roles to whom the audit and accountability procedures are to be disseminated | AU-1 | The people who carry them out, and the system owners | Chief Information Security Officer |
| Select one or more: organization-level; mission/business process-level; system-level | AU-1 | Organization-level | Chief Information Security Officer |
| An official to manage the audit and accountability policy and procedures | AU-1 | Chief Information Security Officer | Chief Information Security Officer |
| The frequency at which the current audit and accountability policy is reviewed and updated | AU-1 | Annually | Chief Information Security Officer |
| Events that would require the current audit and accountability policy to be reviewed and updated | AU-1 | Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines | Chief Information Security Officer |
| The frequency at which the current audit and accountability procedures are reviewed and updated | AU-1 | Annually | Chief Information Security Officer |
| Events that would require audit and accountability procedures to be reviewed and updated | AU-1 | The same events as the policy, and changes to the systems, tools or services the procedures describe | Chief Information Security Officer |
| The event types that the system is capable of logging in support of the audit function | AU-2 | Logons and logoffs, account and privilege changes, use of privileged functions, access to security-relevant files, configuration changes, and security tool events | Chief Information Security Officer |
| The event types for logging within the system | AU-2 | The event types listed in the audit logging standard, each logged whenever it occurs | Chief Information Security Officer |
| The frequency or situation requiring logging for each specified event type | AU-2 | See the row above | Chief Information Security Officer |
| The frequency of event types selected for logging are reviewed and updated | AU-2 | Annually and after a significant incident or system change | Chief Information Security Officer |
| Additional information to be included in audit records | AU-3(1) | Session and request identifiers, source and destination addresses, and the full command line for privileged commands | Chief Information Security Officer |
| Audit log retention requirements | AU-4 | The retention period set under AU-11, with room for a year of growth | Chief Information Security Officer |
| Personnel or roles receiving audit logging process failure alerts | AU-5 | The system administrators and the security operations team | Chief Information Security Officer |
| Time period for personnel or roles receiving audit logging process failure alerts | AU-5 | 1 hour | Chief Information Security Officer |
| Additional actions to be taken in the event of an audit logging process failure | AU-5 | Restore logging and record the gap in the audit trail; for high-impact systems, stop processing that cannot be logged | Chief Information Security Officer |
| Frequency at which system audit records are reviewed and analyzed | AU-6 | Continuously through automated alerting, with a documented manual review at least weekly | Chief Information Security Officer |
| Inappropriate or unusual activity | AU-6 | The activity listed in the log review procedure, such as repeated failed logons, privilege escalation and access outside normal patterns | Chief Information Security Officer |
| Personnel or roles to receive findings from reviews and analyses of system records | AU-6 | The system owner and the incident response team | Chief Information Security Officer |
| Automated mechanisms used for integrating audit record review, analysis, and reporting processes | AU-6(1) | A security information and event management (SIEM) platform | Chief Information Security Officer |
| Fields within audit records that can be processed, sorted, or searched | AU-7(1) | Event type, time, source and destination, user identity, outcome and system component | Chief Information Security Officer |
| Granularity of time measurement for audit record timestamps | AU-8 | One second or finer | Chief Information Security Officer |
| Personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information | AU-9 | The security operations team and the system owner | Chief Information Security Officer |
| A subset of privileged users or roles authorized to access management of audit logging functionality | AU-9(4) | The security operations administrators, who do not administer the systems being audited | Chief Information Security Officer |
| A time period to retain audit records that is consistent with the records retention policy | AU-11 | At least one year, or longer where the records retention schedule or a law requires it | Chief Information Security Officer |
| System components that provide an audit record generation capability for the events types | AU-12 | All servers, network devices, security tools, databases and applications in the system boundary | Chief Information Security Officer |
| Personnel or roles allowed to select the event types that are to be logged by specific components of the system | AU-12 | The system administrators, with the security operations team approving changes | Chief Information Security Officer |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.