03.03: Audit and Accountability

Specify the following event types selected for logging within the system: [Assignment: organization-defined event types]. Review and update the event types selected for logging [Assignment: organization-defined frequency].

Include the following content in audit records: What type of event occurred When the event occurred Where the event occurred Source of the event Outcome of the event Identity of the individuals, subjects, objects, or entities associated with the event Provide additional information for audit records as needed.

Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. Retain audit records for a time period consistent with the records retention policy.

Alert organizational personnel or roles within [Assignment: organization-defined time period] in the event of an audit logging process failure. Take the following additional actions: [Assignment: organization-defined additional actions].

Review and analyze system audit records [Assignment: organization-defined frequency] for indications and the potential impact of inappropriate or unusual activity. Report findings to organizational personnel or roles. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. Preserve the original content and time ordering of audit records.

Use internal system clocks to generate time stamps for audit records. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.

Protect audit information and audit logging tools from unauthorized access, modification, and deletion. Authorize access to management of audit logging functionality to only a subset of privileged users or roles.