AU-4

Requirement

Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].

Discussion

Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit storage capacity; system security plan; privacy plan; system design documentation; system configuration settings and associated documentation; audit record storage requirements; audit record storage capability for system components; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Audit record storage capacity and related configuration settings].

ID	Assessment Objectives
AU-04	audit log storage capacity is allocated to accommodate <AU-04_ODP audit log retention requirements>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!