AU-6(6)

Requirement

Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

Discussion

The correlation of physical audit record information and the audit records from systems may assist organizations in identifying suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual's identity for logical access to certain systems with the additional physical security information that the individual was present at the facility when the logical access occurred may be useful in investigations.

Title

Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
Family

Audit and Accountability
NIST 800-53B Baseline(s)
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporting; procedures addressing physical access monitoring; system design documentation; system configuration settings and associated documentation; documentation providing evidence of correlated information obtained from audit records and physical access monitoring records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit review, analysis, and reporting responsibilities; organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Mechanisms implementing the capability to correlate information from audit records with information from monitoring physical access].

ID	Assessment Objectives
AU-06(06)	information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!