AU-3(3)

Requirement

Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].

Discussion

Limiting personally identifiable information in audit records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.

Title

Content of Audit Records | Limit Personally Identifiable Information Elements
Family

Audit and Accountability
NIST 800-53B Baseline(s)
- Privacy

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; privacy risk assessment; privacy risk assessment results; procedures addressing content of audit records; system design documentation; system configuration settings and associated documentation; list of organization-defined auditable events; system audit records; third party contracts; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

ID	Assessment Objectives
AU-03(03)	personally identifiable information contained in audit records is limited to <AU-03(03)_ODP elements> identified in the privacy risk assessment.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!