AU-6 Audit record review, analysis, and reporting
Requires audit records to be reviewed and analysed on a defined frequency for indications of organization-defined inappropriate or unusual activity and its likely impact, findings to be reported to defined personnel, and
4
artefacts
0
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Defined review frequency and the activity indicators being looked for · Policy repository / GRC workspace
- Completed review records with reviewer, date and findings · Policy repository / GRC workspace
- Reports issued to the defined recipients and evidence of follow-up · Policy repository / GRC workspace
- Record of a review level adjustment made in response to changed risk · Policy repository / GRC workspace
governing documentDocuments that govern the control
none for this control
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Review is automated alerting only, with no periodic analytical review for slow patterns
- Findings recorded but never reported to anyone able to act
- No mechanism to raise review intensity when threat information changes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAU-5 Response to audit logging process failures · AU-7 Audit record reduction and report generation