home || catalog: SP800-53rev3 / class: Technical / family: (AU) Audit and Accountability ||
search controls:
search nistpubs:

AC
AT
AU

AU-01
AU-02
AU-03
AU-04
AU-05
AU-06
AU-07
AU-08
AU-09 *
AU-10
AU-11
AU-12
AU-13
AU-14

CA
CM
CP
IA
IR
MA
MP
PE
PL
PM
PS
RA
SA
SC
SI
MMMMM

  AU-09: Protection of Audit Information  

base control objective:
The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

supplemental objective information:
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.

enhancements to the base objective:

(1) The information system produces audit records on hardware-enforced, write-once media.

(2) The information system backs up audit records [Assignment: organization-defined frequency] onto a different system or media than the system being audited.

(3) The information system uses cryptographic mechanisms to protect the integrity of audit information and audit tools.

Enhancement Supplemental Guidance: An example of a cryptographic mechanism for the protection of integrity is the computation and application of a cryptographic-signed hash using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information.

(4) The organization:
(a) Authorizes access to management of audit functionality to only a limited subset of privileged users; and
(b) Protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.

Enhancement Supplemental Guidance: Auditing may not be reliable when performed by the information system to which the user being audited has privileged access. The privileged user may inhibit auditing or modify audit records. This control enhancement helps mitigate this risk by requiring that privileged access be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved, for example, by performing audit activity on a separate information system or by using storage media that cannot be modified (e.g., write-once recording devices).

mapping to FIPS199 baseline:

  LOW: base     MOD: base     HIGH: base  

related (regimented) controls:

AC-03   Access Enforcement
AC-06   Least Privilege

documents referenced in SP800-53rev3 for AU-09:

Document Date Status Title
NIST SP800-12 October, 1995 current   An Introduction to Computer Security: The NIST Handbook
NIST SP800-124 July, 2008 current   Guidelines on Cell Phone and PDA Security
NIST SP800-19 October, 1999 current   Mobile Agent Security
NIST SP800-45 August, 2006 DRAFT   Guidelines on Electronic Mail Security
NIST SP800-72 November, 2004 current   Guidelines on PDA Forensics
NIST SP800-92 September, 2006 current   Guide to Computer Security Log Management
NIST SP800-94 August, 2006 DRAFT   Guide to Intrusion Detection and Prevention Systems (IDPS)

Search SP800-53rev3 catalog: