AU-6(4)

Requirement

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

Discussion

Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; system design documentation; system configuration settings and associated documentation; system security plan; privacy plan; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit review, analysis, and reporting responsibilities; organizational personnel with information security and privacy responsibilities; system developers].

Test

[SELECT FROM: System capability to centralize review and analysis of audit records].

ID	Assessment Objectives
AU-06(04)[01]	the capability to centrally review and analyze audit records from multiple components within the system is provided;
AU-06(04)[02]	the capability to centrally review and analyze audit records from multiple components within the system is implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!