ComplianceNIST 800-53 control

NIST-AU-6 Audit Record Review, Analysis, and Reporting

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
AU Audit and Accountability
Control
AU-6

Control statement

a. Review and analyze system audit records [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [Assignment: personnel or roles] ; and c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Discussion

Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.

Related

Related control · Compliance (30)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-AU-16 Cross-organizational Audit Logging NIST 800-53 control
  • NIST-AU-7 Audit Record Reduction and Report Generation NIST 800-53 control
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-10 Software Usage Restrictions NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IR-5 Incident Monitoring NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (8)

  • NIST-AU-6(1) Automated Process Integration NIST 800-53 enhancement
  • NIST-AU-6(3) Correlate Audit Record Repositories NIST 800-53 enhancement
  • NIST-AU-6(4) Central Review and Analysis NIST 800-53 enhancement
  • NIST-AU-6(5) Integrated Analysis of Audit Records NIST 800-53 enhancement
  • NIST-AU-6(6) Correlation with Physical Monitoring NIST 800-53 enhancement
  • NIST-AU-6(7) Permitted Actions NIST 800-53 enhancement
  • NIST-AU-6(8) Full Text Analysis of Privileged Commands NIST 800-53 enhancement
  • NIST-AU-6(9) Correlation with Information from Nontechnical Sources NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-AU Audit and Accountability NIST 800-53 family

Referenced by Compliance · related control (40)

  • NIST-AC-17(1) Monitoring and Control NIST 800-53 enhancement
  • NIST-AC-2(12) Account Monitoring for Atypical Usage NIST 800-53 enhancement
  • NIST-AC-2(13) Disable Accounts for High-risk Individuals NIST 800-53 enhancement
  • NIST-AC-2(4) Automated Audit Actions NIST 800-53 enhancement
  • NIST-AC-3(10) Audited Override of Access Control Mechanisms NIST 800-53 enhancement
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-AU-11 Audit Record Retention NIST 800-53 control
  • NIST-AU-12 Audit Record Generation NIST 800-53 control
  • NIST-AU-16 Cross-organizational Audit Logging NIST 800-53 control
  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
  • NIST-AU-7 Audit Record Reduction and Report Generation NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-10 Software Usage Restrictions NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3(7) Review System Changes NIST 800-53 enhancement
  • NIST-CM-5(1) Automated Access Enforcement and Audit Records NIST 800-53 enhancement
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IR-4 Incident Handling NIST 800-53 control
  • NIST-IR-5 Incident Monitoring NIST 800-53 control
  • NIST-MA-4(1) Logging and Review NIST 800-53 enhancement
  • NIST-MP-4(2) Automated Restricted Access NIST 800-53 enhancement
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
Show all 40 ›