Information Technology Reference
In-Depth Information
Category/
Subcategory/
Element
Control
Reference
Control Summary
Interpretation
AU-6
Audit monitoring,
analysis, and
reporting
The organization regularly reviews/
analyzes information system audit
records for indications of
inappropriate or unusual activity,
investigates suspicious activity or
suspected violations, reports
findings to appropriate officials,
and takes necessary actions.
AU-7
Audit reduction and
report generation
The information system provides
an audit reduction and report
generation capability.
AU-8
Time stamps
The information system provides
time stamps for use in audit
record generation.
AU-9
Protection of audit
information
The information system protects
audit information and audit tools
from unauthorized access,
modification, and deletion.
AU-10
Nonrepudiation
The information system provides
the capability to determine
whether a given individual took a
particular action.
AU-11
Audit record
retention
The organization retains audit
records for [assignment:
organization-defined time period]
to provide support for after-the-
fact investigations of security
incidents and to meet regulatory
and organizational information
retention requirements.
Certification,
Accreditation, and
Security
Assessments
CA
CA-1
Certification,
accreditation, and
security assessment
policies and
procedures
The organization develops,
disseminates, and periodically
reviews/updates: (i) formal,
documented security assessment
and certification and accreditation
policies that address purpose,
scope, roles, responsibilities,
management commitment,
coordination among
organizational entities, and
