ComplianceNIST 800-53 control

NIST-AU-9 Protection of Audit Information

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
AU Audit and Accountability
Control
AU-9

Control statement

a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

Discussion

Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.

Related

Related control · not in database (1)

Related control · Compliance (13)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AU-11 Audit Record Retention NIST 800-53 control
  • NIST-AU-14 Session Audit NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-PE-2 Physical Access Authorizations NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · enhancement of (7)

  • NIST-AU-9(1) Hardware Write-once Media NIST 800-53 enhancement
  • NIST-AU-9(2) Store on Separate Physical Systems or Components NIST 800-53 enhancement
  • NIST-AU-9(3) Cryptographic Protection NIST 800-53 enhancement
  • NIST-AU-9(4) Access by Subset of Privileged Users NIST 800-53 enhancement
  • NIST-AU-9(5) Dual Authorization NIST 800-53 enhancement
  • NIST-AU-9(6) Read-only Access NIST 800-53 enhancement
  • NIST-AU-9(7) Store on Component with Different Operating System NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-AU Audit and Accountability NIST 800-53 family

Referenced by Compliance · related control (20)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6(1) Authorize Access to Security Functions NIST 800-53 enhancement
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-11 Audit Record Retention NIST 800-53 control
  • NIST-AU-14 Session Audit NIST 800-53 control
  • NIST-AU-4 Audit Log Storage Capacity NIST 800-53 control
  • NIST-AU-5 Response to Audit Logging Process Failures NIST 800-53 control
  • NIST-AU-5(5) Alternate Audit Logging Capability NIST 800-53 enhancement
  • NIST-AU-6(8) Full Text Analysis of Privileged Commands NIST 800-53 enhancement
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4(2) Automated Restricted Access NIST 800-53 enhancement
  • NIST-PE-2 Physical Access Authorizations NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-PE-6 Monitoring Physical Access NIST 800-53 control
  • NIST-SA-8(22) Accountability and Traceability NIST 800-53 enhancement
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-29 Heterogeneity NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control