AU-12 Audit record generation
Requires the system to be able to generate audit records for the auditable event types on organization-defined components, to let defined personnel choose which events specific components log, and to produce records carr
system holds itEvidence a system already holds
- Configuration showing logging enabled on each in scope component · SIEM / log platform
- Sample generated audit records demonstrating the required content fields · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- List of system components in scope for audit record generation · Policy repository / GRC workspace
- Documentation of which roles may change the event selection and how that is controlled · Policy repository / GRC workspace
First move
Common gaps auditors find
- Logging enabled on servers but absent on network devices, containers or cloud control planes
- Ability to change event selection is unrestricted, so logging can be silently reduced
- Records generated but stripped of fields needed to attribute the event
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAU-11 Audit record retention · AU-13 Monitoring for Information Disclosure. Monitor [organization-defined] [organization-defined] for evidence of unauthorized disclosure of organizational information; and If an information disclosure is discovered: Notify [organization-defined] ; and Take the following additional actions: [organization-defined]