AU-5(4)

Requirement

Invoke a [Selection: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-defined audit logging failures], unless an alternate audit logging capability exists.

Discussion

Organizations determine the types of audit logging failures that can trigger automatic system shutdowns or degraded operations. Because of the importance of ensuring mission and business continuity, organizations may determine that the nature of the audit logging failure is not so severe that it warrants a complete shutdown of the system supporting the core organizational mission and business functions. In those instances, partial system shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentation; system security plan; privacy plan; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: System capability invoking system shutdown or degraded operational mode in the event of an audit processing failure].

ID	Assessment Objectives
AU-05(04)	<AU-05(04)_ODP[01] SELECTED PARAMETER VALUES> is/are invoked in the event of <AU-05(04)_ODP[02] audit logging failures> , unless an alternate audit logging capability exists.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!