Lexim011/Compliance huggingface dataset:
CCI-000109 (policy): Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.
References: NIST: NIST SP 800-53 (v3): AT-3 NIST: NIST SP 800-53 Revision 4 (v4): AT-3 b NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 2 NIST: NIST SP 800-53A (v1): AT-3.1 (i)
CCI-003782 (policy): Defines the roles and responsibilities of the personnel providing role-based security and privacy training.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a
CCI-003783 (policy): Provide role-based privacy training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 1
CCI-003784 (policy): Provide role-based privacy training to personnel with organization-defined roles and responsibilities when required by system changes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 2
CCI-003785 (policy): Update role-based training content on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b
CCI-003786 (policy): Defines the frequency of which the role-based training content is updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b
CCI-003787 (policy): Update role-based training content following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b
CCI-003788 (policy): Defines the events following updating role-based training content.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b
CCI-003789 (policy): Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 c
CCI-001481 (policy): Provide organization-defined personnel or roles with initial training in the employment and operation of environmental controls.
References: NIST: NIST SP 800-53 (v3): AT-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) NIST: NIST SP 800-53A (v1): AT-3 (1).1 (i)
CCI-001482 (policy): Provide organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) NIST: NIST SP 800-53A (v1): AT-3 (1).1 (iii)
CCI-001483 (policy): Defines a frequency for providing employees with refresher training in the employment and operation of environmental controls.
References: NIST: NIST SP 800-53 (v3): AT-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) NIST: NIST SP 800-53A (v1): AT-3 (1).1 (ii)
CCI-002050 (policy): Defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1)
CCI-001566 (policy): Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
References: NIST: NIST SP 800-53 (v3): AT-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) NIST: NIST SP 800-53A (v1): AT-3 (2).1 (i)
CCI-001567 (policy): Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) NIST: NIST SP 800-53A (v1): AT-3 (2).1 (iii)
CCI-001568 (policy): Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
References: NIST: NIST SP 800-53 (v3): AT-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) NIST: NIST SP 800-53A (v1): AT-3 (2).1 (ii)
CCI-002051 (policy): Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2)
CCI-002052 (policy): Provide practical exercises in security training that reinforce training objectives.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (3)
CCI-003790 (policy): Provide practical exercises in privacy training that reinforce training objectives.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (3)
CCI-003791 (policy): Defines the frequency for providing training in the employment and operation of personally identifiable information processing and transparency controls to personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5)
CCI-003792 (policy): Provide organization-defined personnel or roles with initial training in the employment and operation of personally identifiable information processing and transparency controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5)
CCI-003793 (policy): Defines the personnel or roles who are to be provided training in the employment and operation of personally identifiable information processing and transparency controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5)
CCI-000113 (policy): Document individual security training activities, including security awareness training and specific system security training.
References: NIST: NIST SP 800-53 (v3): AT-4 a NIST: NIST SP 800-53 Revision 4 (v4): AT-4 a NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a NIST: NIST SP 800-53A (v1): AT-4.1 (i)
CCI-000114 (policy): Monitor individual information security training activities, including security awareness training and specific security training.
References: NIST: NIST SP 800-53 (v3): AT-4 a NIST: NIST SP 800-53 Revision 4 (v4): AT-4 a NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a NIST: NIST SP 800-53A (v1): AT-4.1 (i)
CCI-003794 (policy): Document individual privacy training activities, including privacy awareness training and specific system privacy training.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a
CCI-003795 (policy): Monitor individual information privacy training activities, including privacy awareness training and specific privacy training.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a
CCI-001336 (policy): Retain individual training records for an organization-defined time-period.
References: NIST: NIST SP 800-53 (v3): AT-4 b NIST: NIST SP 800-53 Revision 4 (v4): AT-4 b NIST: NIST SP 800-53 Revision 5 (v5): AT-4 b NIST: NIST SP 800-53A (v1): AT-4.1 (iii)
CCI-001337 (policy): Defines the time period for retaining individual training records.
References: NIST: NIST SP 800-53 (v3): AT-4 b NIST: NIST SP 800-53 Revision 4 (v4): AT-4 b NIST: NIST SP 800-53 Revision 5 (v5): AT-4 b NIST: NIST SP 800-53A (v1): AT-4.1 (ii)
CCI-003796 (policy): Provide feedback on organizational training results to organization-defined personnel on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-6
CCI-003797 (policy): Defines the frequency of which feedback is provided on organizational training results.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-6
CCI-003798 (policy): Defines the organizational personnel or roles who provide feedback on organizational training results.
References: NIST: NIST SP 800-53 Revision 5 (v5): AT-6
CCI-000117 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): AU-1 a NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (a) NIST: NIST SP 800-53A (v1): AU-1.1 (I and ii)
CCI-000120 (policy): Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
References: NIST: NIST SP 800-53 (v3): AU-1 b NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2 NIST: NIST SP 800-53A (v1): AU-1.1 (iv and v)
CCI-001832 (policy): Disseminate the organization-level; mission/business process-level; and/or system-level audit and accountability policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (a)
CCI-001834 (policy): Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2
CCI-001930 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1
CCI-001931 (policy): Defines the personnel or roles to whom the audit and accountability procedures are to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2
CCI-003799 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (b)
CCI-003800 (policy): Designate an organization-defined official to manage the development and documentation of the audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-003801 (policy): Designate an organization-defined official to manage the dissemination of the audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-003802 (policy): Designate an organization-defined official to manage the development and documentation of the audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-003803 (policy): Designate an organization-defined official to manage the dissemination of the audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-003804 (policy): Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-003805 (policy): Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b
CCI-000119 (policy): Review and update the current audit and accountability policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AU-1 a NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 NIST: NIST SP 800-53A (v1): AU-1.2 (ii)
CCI-000122 (policy): Review and update the current audit and accountability procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AU-1 b NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 NIST: NIST SP 800-53A (v1): AU-1.2 (iv)
CCI-001569 (policy): Defines the frequency on which the current audit and accountability policy will be reviewed and updated.
References: NIST: NIST SP 800-53 (v3): AU-1 a NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 NIST: NIST SP 800-53A (v1): AU-1.2 (i)
CCI-001570 (policy): Defines the frequency on which the current audit and accountability procedures will be reviewed and updated.
References: NIST: NIST SP 800-53 (v3): AU-1 b NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 NIST: NIST SP 800-53A (v1): AU-1.2 (iii)
CCI-003806 (policy): Review and update the current audit and accountability policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1
CCI-003807 (policy): Defines the events following reviewing and updating the current audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1
CCI-003808 (policy): Review and update the current audit and accountability procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2
CCI-003809 (policy): Defines the events following reviewing and updating the current audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2
CCI-000123 (policy): Identify the organization-defined event types that the system is capable of logging in support of the audit function.
References: NIST: NIST SP 800-53 (v3): AU-2 a NIST: NIST SP 800-53 Revision 4 (v4): AU-2 a NIST: NIST SP 800-53 Revision 5 (v5): AU-2 a NIST: NIST SP 800-53A (v1): AU-2.1 (ii)
CCI-001571 (policy): Defines the event types that the system is capable of logging in support of the audit function.
References: NIST: NIST SP 800-53 (v3): AU-2 a NIST: NIST SP 800-53 Revision 4 (v4): AU-2 a NIST: NIST SP 800-53 Revision 5 (v5): AU-2 a NIST: NIST SP 800-53A (v1): AU-2.1 (i)
CCI-000124 (policy): Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.
References: NIST: NIST SP 800-53 (v3): AU-2 b NIST: NIST SP 800-53 Revision 4 (v4): AU-2 b NIST: NIST SP 800-53 Revision 5 (v5): AU-2 b NIST: NIST SP 800-53A (v1): AU-2.1 (iii)
CCI-000126 (policy): Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type.
References: NIST: NIST SP 800-53 (v3): AU-2 d NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c NIST: NIST SP 800-53A (v1): AU-2.1 (v)
CCI-001484 (policy): Defines the frequency of (or situation requiring) logging for each identified event.
References: NIST: NIST SP 800-53 (v3): AU-2 d NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c NIST: NIST SP 800-53A (v1): AU-2.1 (v)
CCI-001485 (policy): Defines the event types for logging within the system.
References: NIST: NIST SP 800-53 (v3): AU-2 d NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c NIST: NIST SP 800-53A (v1): AU-2.1 (vi)
CCI-000125 (policy): Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents.
References: NIST: NIST SP 800-53 (v3): AU-2 c NIST: NIST SP 800-53 Revision 4 (v4): AU-2 c NIST: NIST SP 800-53 Revision 5 (v5): AU-2 d NIST: NIST SP 800-53A (v1): AU-2.1 (iv)
CCI-003810 (policy): Review and update the event types selected for logging on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-2 e
CCI-003811 (policy): Defines the frequency at which the event types selected for logging will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-2 e
CCI-000130 (technical): Ensure that audit records containing information that establishes what type of event occurred.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 a NIST: NIST SP 800-53A (v1): AU-3.1
CCI-000131 (technical): Ensure that audit records containing information that establishes when the event occurred.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 b NIST: NIST SP 800-53A (v1): AU-3.1
CCI-000132 (technical): Ensure that audit records containing information that establishes where the event occurred.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 c NIST: NIST SP 800-53A (v1): AU-3.1
CCI-000133 (technical): Ensure that audit records containing information that establishes the source of the event.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 d NIST: NIST SP 800-53A (v1): AU-3.1
CCI-000134 (technical): Ensure that audit records containing information that establishes the outcome of the event.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 e NIST: NIST SP 800-53A (v1): AU-3.1
CCI-001487 (technical): Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
References: NIST: NIST SP 800-53 (v3): AU-3 NIST: NIST SP 800-53 Revision 4 (v4): AU-3 NIST: NIST SP 800-53 Revision 5 (v5): AU-3 f NIST: NIST SP 800-53A (v1): AU-3.1
CCI-000135 (technical): Generate audit records containing the organization-defined additional information that is to be included in the audit records.
References: NIST: NIST SP 800-53 (v3): AU-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (1) NIST: NIST SP 800-53A (v1): AU-3 (1).1 (ii)
CCI-001488 (policy): Defines the additional information to be included in the audit records.
References: NIST: NIST SP 800-53 (v3): AU-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (1) NIST: NIST SP 800-53A (v1): AU-3 (1).1 (i)
CCI-003812 (policy): Limit personally identifiable information contained in audit records to organization-defined elements identified in the privacy risk assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (3)
CCI-003813 (policy): Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in audit records.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (3)
CCI-001848 (policy): Defines the audit log retention requirements for allocating audit log storage capacity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-4 NIST: NIST SP 800-53 Revision 5 (v5): AU-4
CCI-001849 (policy, technical): Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-4 NIST: NIST SP 800-53 Revision 5 (v5): AU-4
CCI-001850 (policy): Defines the frequency to off-load audit records onto a different system or media than the system being audited.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-4 (1)
CCI-001851 (technical): Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-4 (1)
CCI-000139 (technical): Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
References: NIST: NIST SP 800-53 (v3): AU-5 a NIST: NIST SP 800-53 Revision 4 (v4): AU-5 a NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a NIST: NIST SP 800-53A (v1): AU-5.1 (ii)
CCI-001572 (policy): Defines the personnel or roles to be alerted in the event of an audit logging process failure.
References: NIST: NIST SP 800-53 (v3): AU-5 a NIST: NIST SP 800-53 Revision 4 (v4): AU-5 a NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a NIST: NIST SP 800-53A (v1): AU-5.1 (i)
CCI-003814 (policy): Defines the time-period for the alert in the event of an audit process failure.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a
CCI-000140 (technical): Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.
References: NIST: NIST SP 800-53 (v3): AU-5 b NIST: NIST SP 800-53 Revision 4 (v4): AU-5 b NIST: NIST SP 800-53 Revision 5 (v5): AU-5 b NIST: NIST SP 800-53A (v1): AU-5.1 (iv)
CCI-001490 (policy): Defines the actions to be taken by the system upon audit failure, including shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.
References: NIST: NIST SP 800-53 (v3): AU-5 b NIST: NIST SP 800-53 Revision 4 (v4): AU-5 b NIST: NIST SP 800-53 Revision 5 (v5): AU-5 b NIST: NIST SP 800-53A (v1): AU-5.1 (iii)
CCI-001852 (policy): Defines the personnel, roles and/or locations to receive a warning when allocated audit log storage volume reaches a defined percentage of maximum audit log storage capacity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1)
CCI-001853 (policy): Defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit log storage volume reaches an organization-defined percentage of maximum audit log storage capacity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1)
CCI-001854 (policy): Defines the percentage of maximum audit log storage capacity that is to be reached, at which time the system will provide a warning to organization-defined personnel, roles, and/or locations.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1)
CCI-001855 (technical): Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1)
CCI-000147 (policy): Defines the audit logging failure events requiring real-time alerts.
References: NIST: NIST SP 800-53 (v3): AU-5 (2) NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2) NIST: NIST SP 800-53A (v1): AU-5 (2).1 (i)
CCI-001856 (policy): Defines the real-time period in which to provide an alert when organization-defined audit failure events occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2)
CCI-001857 (policy): Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2)
CCI-001858 (technical): Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2)
CCI-000145 (policy): Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds.
References: NIST: NIST SP 800-53 (v3): AU-5 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3) NIST: NIST SP 800-53A (v1): AU-5 (3).1 (i)
CCI-001573 (policy): Defines whether to reject or delay network traffic that exceeds organization-defined thresholds.
References: NIST: NIST SP 800-53 (v3): AU-5 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3) NIST: NIST SP 800-53A (v1): AU-5 (3).1 (ii)
CCI-001859 (policy): Defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3)
CCI-001860 (policy): Defines the audit logging failures which, should they occur, will invoke an organization-defined system mode.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4)
CCI-001861 (technical): Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4)
CCI-002907 (policy): Defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission or business functionality available, in the event of organization-defined audit logging failures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4)
CCI-003815 (policy): Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements organization-defined alternate audit logging functionality.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (5)
CCI-003816 (policy): Defines the alternate audit logging functionality in the event of a failure in primary audit logging capability.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (5)
CCI-000148 (policy): Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity.
References: NIST: NIST SP 800-53 (v3): AU-6 a NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a NIST: NIST SP 800-53A (v1): AU-6.1 (ii)
CCI-000151 (policy): Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity.
References: NIST: NIST SP 800-53 (v3): AU-6 a NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a NIST: NIST SP 800-53A (v1): AU-6.1 (i)
CCI-001862 (policy): Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a
CCI-003817 (policy): Review and analyze the potential impact of the organization-defined inappropriate or unusual activity.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a
CCI-000149 (policy): Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity.
References: NIST: NIST SP 800-53 (v3): AU-6 a NIST: NIST SP 800-53 Revision 4 (v4): AU-6 b NIST: NIST SP 800-53 Revision 5 (v5): AU-6 b NIST: NIST SP 800-53A (v1): AU-6.1 (iii)
CCI-001863 (policy): Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 b NIST: NIST SP 800-53 Revision 5 (v5): AU-6 b
CCI-003818 (policy): Adjust the level of audit review and analysis within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-6 c
CCI-003819 (policy): Adjust the level of audit reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-6 c
CCI-001864 (policy): Integrate audit review and analysis using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1)
CCI-001865 (policy): Integrate reporting processes using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1)
CCI-003820 (policy): Defines the automated mechanisms for integrating audit record review, analysis, and reporting processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1)
CCI-000153 (policy): Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
References: NIST: NIST SP 800-53 (v3): AU-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (3) NIST: NIST SP 800-53A (v1): AU-6 (3).1
CCI-000154 (technical): Provide the capability to centrally review and analyze audit records from multiple components within the system.
References: NIST: NIST SP 800-53 (v3): AU-6 (4) NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (4) NIST: NIST SP 800-53A (v1): AU-6 (4).1
CCI-003821 (technical): Implement the capability to centrally review and analyze audit records from multiple components within the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (4)
CCI-001866 (policy): Defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (5) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (5)
CCI-001867 (policy): Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (5) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (5)
CCI-001491 (policy): Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
References: NIST: NIST SP 800-53 (v3): AU-6 (6) NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (6) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (6) NIST: NIST SP 800-53A (v1): AU-6 (6).1
CCI-001868 (policy): Specify the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (7) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (7)
CCI-001869 (policy): Specify the permitted actions for each information system process, role, and/or user associated with the reporting of audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (7) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (7)
CCI-001870 (policy): Perform a full-text analysis of logged privileged commands in a physically-distinct component or subsystem of the system, or other system that is dedicated to that analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (8)
CCI-001871 (policy): Correlate information from non-technical sources with audit record information to enhance organization-wide situational awareness.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (9) NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (9)
CCI-001875 (technical): Provide an audit reduction capability that supports on-demand audit review and analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001876 (technical): Provide an audit reduction capability that supports on-demand reporting requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001877 (technical): Provide an audit reduction capability that supports after-the-fact investigations of incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001878 (technical): Provide a report generation capability that supports on-demand audit review and analysis.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001879 (technical): Provide a report generation capability that supports on-demand reporting requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001880 (technical): Provide a report generation capability that supports after-the-fact investigations of security incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003822 (technical): Implement an audit reduction capability that supports on-demand audit review and analysis.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003823 (technical): Implement an audit reduction capability that supports on-demand reporting requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003824 (technical): Implement an audit reduction capability that supports after-the-fact investigations of incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003825 (technical): Implement a report generation capability that supports on-demand audit review and analysis.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003826 (technical): Implement a report generation capability that supports on-demand reporting requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-003827 (technical): Implement a report generation capability that supports after-the-fact investigations of incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a
CCI-001881 (technical): Provide an audit reduction capability that does not alter original content or time ordering of audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 b NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b
CCI-001882 (technical): Provide a report generation capability that does not alter original content or time ordering of audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 b NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b
CCI-003828 (technical): Implement an audit reduction capability that does not alter original content or time ordering of audit records.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b
CCI-003829 (technical): Implement a report generation capability that does not alter original content or time ordering of audit records.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b
CCI-000158 (technical): Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
References: NIST: NIST SP 800-53 (v3): AU-7 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1) NIST: NIST SP 800-53A (v1): AU-7 (1).1
CCI-001883 (policy): Defines the audit fields within audit records to be processed, sorted, and searched for events of interest by the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1)
CCI-003830 (technical): Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1)
CCI-000159 (technical): Use internal system clocks to generate time stamps for audit records.
References: NIST: NIST SP 800-53 (v3): AU-8 NIST: NIST SP 800-53 Revision 4 (v4): AU-8 a NIST: NIST SP 800-53 Revision 5 (v5): AU-8 a NIST: NIST SP 800-53A (v1): AU-8.1
CCI-001888 (policy): Defines the granularity of time measurement for time stamps generated for audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b
CCI-001889 (technical): Record time stamps for audit records that meet organization-defined granularity of time measurement.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b
CCI-001890 (technical): Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b
CCI-001494 (technical): Protect audit tools from unauthorized modification.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 NIST: NIST SP 800-53A (v1): AU-9.1
CCI-001495 (technical): Protect audit tools from unauthorized deletion.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 NIST: NIST SP 800-53A (v1): AU-9.1
CCI-000162 (technical): Protect audit information from unauthorized access.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a NIST: NIST SP 800-53A (v1): AU-9.1
CCI-000163 (technical): Protect audit information from unauthorized modification.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a NIST: NIST SP 800-53A (v1): AU-9.1
CCI-000164 (technical): Protect audit information from unauthorized deletion.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a NIST: NIST SP 800-53A (v1): AU-9.1
CCI-001493 (technical): Protect audit tools from unauthorized access.
References: NIST: NIST SP 800-53 (v3): AU-9 NIST: NIST SP 800-53 Revision 4 (v4): AU-9 NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a NIST: NIST SP 800-53A (v1): AU-9.1
CCI-003831 (technical): Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-9 b
CCI-003832 (technical): Defines the personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-9 b
CCI-000165 (policy): Write audit records to hardware-enforced, write-once media.
References: NIST: NIST SP 800-53 (v3): AU-9 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (1) NIST: NIST SP 800-53A (v1): AU-9 (1).1
CCI-001348 (technical): Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
References: NIST: NIST SP 800-53 (v3): AU-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (2) NIST: NIST SP 800-53A (v1): AU-9 (2).1 (iii)
CCI-001349 (policy): Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited.
References: NIST: NIST SP 800-53 (v3): AU-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (2) NIST: NIST SP 800-53A (v1): AU-9 (2).1 (ii)
CCI-001350 (technical): Implement cryptographic mechanisms to protect the integrity of audit information.
References: NIST: NIST SP 800-53 (v3): AU-9 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (3) NIST: NIST SP 800-53A (v1): AU-9 (3).1
CCI-001496 (technical): Implement cryptographic mechanisms to protect the integrity of audit tools.
References: NIST: NIST SP 800-53 (v3): AU-9 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (3) NIST: NIST SP 800-53A (v1): AU-9 (3).1
CCI-001351 (policy): Authorize access to management of audit logging functionality to only an organization-defined subset of privileged users or roles.
References: NIST: NIST SP 800-53 (v3): AU-9 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (4) NIST: NIST SP 800-53A (v1): AU-9 (4).1 (i)
CCI-001894 (policy): Defines the subset of privileged users who will be authorized access to the management of audit functionality.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (4)
CCI-001895 (policy): Defines the audit information requiring dual authorization for movement or deletion actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (5)
CCI-001896 (technical): Enforce dual authorization for movement and/or deletion of organization-defined audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (5) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (5)
CCI-001897 (policy): Defines the subset of privileged users or roles who will be authorized read-only access to audit information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (6) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (6)
CCI-001898 (policy): Authorize read-only access to audit information to an organization-defined subset of privileged users or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (6) NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (6)
CCI-003833 (policy): Store audit information on a component running a different operating system than the system component being audited.
References: NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (7)
CCI-000166 (technical): Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
References: NIST: NIST SP 800-53 (v3): AU-10 NIST: NIST SP 800-53 Revision 4 (v4): AU-10 NIST: NIST SP 800-53 Revision 5 (v5): AU-10 NIST: NIST SP 800-53A (v1): AU-10.1
CCI-001899 (policy): Defines the actions to be covered by non-repudiation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 NIST: NIST SP 800-53 Revision 5 (v5): AU-10
CCI-001900 (policy): Defines the strength of binding to be applied to the binding of the identity of the information producer with the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (a)
CCI-001901 (technical): Bind the identity of the information producer with the information to an organization-defined strength of binding.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (a)
CCI-001902 (technical): Provide the means for authorized individuals to determine the identity of the producer of the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (b)
CCI-001903 (policy): Defines the frequency on which the information system is to validate the binding of the information producer identity to the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (a)
CCI-001904 (technical): Validates the binding of the information producer identity to the information at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (a)
CCI-001905 (policy): Defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (b)
CCI-001906 (technical): Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (b)
CCI-001340 (technical): Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released.
References: NIST: NIST SP 800-53 (v3): AU-10 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (3) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (3) NIST: NIST SP 800-53A (v1): AU-10 (3).1
CCI-001341 (technical): Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between organization-defined security domains.
References: NIST: NIST SP 800-53 (v3): AU-10 (4) NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (a) NIST: NIST SP 800-53A (v1): AU-10 (4).1
CCI-001907 (policy): Defines the security domains which will require the information system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (a)
CCI-001908 (policy): Defines the action the system is to perform in the event of an information reviewer identity binding validation error.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (b)
CCI-001909 (technical): Perform organization-defined actions in the event of an information reviewer identity binding validation error.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (b)
CCI-000167 (policy): Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
References: NIST: NIST SP 800-53 (v3): AU-11 NIST: NIST SP 800-53 Revision 4 (v4): AU-11 NIST: NIST SP 800-53 Revision 5 (v5): AU-11 NIST: NIST SP 800-53A (v1): AU-11.1 (iii)
CCI-000168 (policy): Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements.
References: NIST: NIST SP 800-53 (v3): AU-11 NIST: NIST SP 800-53 Revision 4 (v4): AU-11 NIST: NIST SP 800-53 Revision 5 (v5): AU-11 NIST: NIST SP 800-53A (v1): AU-11.1 (i and ii)
CCI-002044 (policy): Defines measures to be employed to ensure that long-term audit records generated by the system can be retrieved.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-11 (1)
CCI-002045 (policy): Employ organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): AU-11 (1)
CCI-000169 (technical): Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
References: NIST: NIST SP 800-53 (v3): AU-12 a NIST: NIST SP 800-53 Revision 4 (v4): AU-12 a NIST: NIST SP 800-53 Revision 5 (v5): AU-12 a NIST: NIST SP 800-53A (v1): AU-12.1 (ii)
CCI-001459 (policy): Defines system components that provide audit record generation capability.
References: NIST: NIST SP 800-53 (v3): AU-12 a NIST: NIST SP 800-53 Revision 4 (v4): AU-12 a NIST: NIST SP 800-53 Revision 5 (v5): AU-12 a NIST: NIST SP 800-53A (v1): AU-12.1 (i)
CCI-000171 (technical): Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
References: NIST: NIST SP 800-53 (v3): AU-12 b NIST: NIST SP 800-53 Revision 4 (v4): AU-12 b NIST: NIST SP 800-53 Revision 5 (v5): AU-12 b NIST: NIST SP 800-53A (v1): AU-12.1 (iii)
CCI-001910 (policy): Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-12 b NIST: NIST SP 800-53 Revision 5 (v5): AU-12 b