AU-5(3)

Requirement

Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection: reject; delay] network traffic above those thresholds.

Discussion

Organizations have the capability to reject or delay the processing of network communications traffic if audit logging information about such traffic is determined to exceed the storage capacity of the system audit logging function. The rejection or delay response is triggered by the established organizational traffic volume thresholds that can be adjusted based on changes to audit log storage capacity.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentation; system security plan; privacy plan; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

ID	Assessment Objectives
AU-05(03)[01]	configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced;
AU-05(03)[02]	network traffic is <AU-05(03)_ODP SELECTED PARAMETER VALUES> if network traffic volume is above configured thresholds.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!