AU-9(3)

Requirement

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Discussion

Cryptographic mechanisms used for protecting the integrity of audit information include signed hash functions using asymmetric cryptography. This enables the distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system hardware settings; system configuration settings and associated documentation; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Cryptographic mechanisms protecting the integrity of audit information and tools].

ID	Assessment Objectives
AU-09(03)	cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!