AU-7(1)

Requirement

Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].

Discussion

Events of interest can be identified by the content of audit records, including system resources involved, information objects accessed, identities of individuals, event types, event locations, event dates and times, Internet Protocol addresses involved, or event success or failure. Organizations may define event criteria to any degree of granularity required, such as locations selectable by a general networking location or by specific system component.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit reduction and report generation; system design documentation; system configuration settings and associated documentation; audit reduction, review, analysis, and reporting tools; audit record criteria (fields) establishing events of interest; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit reduction and report generation responsibilities; organizational personnel with information security and privacy responsibilities; system developers].

ID	Assessment Objectives
AU-07(01)[01]	the capability to process, sort, and search audit records for events of interest based on <AU-07(01)_ODP fields within audit records> are provided;
AU-07(01)[02]	the capability to process, sort, and search audit records for events of interest based on <AU-07(01)_ODP fields within audit records> are implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!