|

controlAU-2

Event Logging (AU-2)

Identify the types of events that the system is capable of logging in support of the audit function: [organization-defined]; Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; Specify the following event types for logging within the system: [organization-defined]; Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-t

Security Baselines

LOWMODERATEHIGH

auditaccountabilitylogging

Why These Connect

Maps To4

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports43

These related controls work together — a change to one may affect the others.

Mitigates4

This control helps defend against or reduce the risk of the linked threat technique.

Enhances4

These enhancements add specific capabilities or refinements to the base control.

Related Controls(37)

AC-2Account Management (AC-2)

AC-7Unsuccessful Logon Attempts (AC-7)

AC-16Security and Privacy Attributes (AC-16)AC-3Access Enforcement (AC-3)

AC-6Least Privilege (AC-6)

AC-8System Use Notification (AC-8)

AC-17Remote Access (AC-17)

AU-3Content of Audit Records (AU-3)

AU-4Audit Log Storage Capacity (AU-4)

AU-5Response to Audit Logging Process Failures (AU-5)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

AU-7Audit Record Reduction and Report Generation (AU-7)

AU-11Audit Record Retention (AU-11)

AU-12Audit Record Generation (AU-12)

CM-3Configuration Change Control (CM-3)

CM-5Access Restrictions for Change (CM-5)

CM-6Configuration Settings (CM-6)

CM-13Data Action Mapping (CM-13)IA-3Device Identification and Authentication (IA-3)

MA-4Nonlocal Maintenance (MA-4)

MP-4Media Storage (MP-4)

PE-3Physical Access Control (PE-3)

PM-21Accounting of Disclosures (PM-21)PT-2Authority to Process Personally Identifiable Information (PT-2)PT-7Specific Categories of Personally Identifiable Information (PT-7)RA-8Privacy Impact Assessments (RA-8)SA-8Security and Privacy Engineering Principles (SA-8)

SC-7Boundary Protection (SC-7)

SC-18Mobile Code (SC-18)

SI-3Malicious Code Protection (SI-3)

SI-4System Monitoring (SI-4)

SI-7Software, Firmware, and Information Integrity (SI-7)

SI-10Information Input Validation (SI-10)

SI-11Error Handling (SI-11)

AU-14Session Audit (AU-14)PE-6Monitoring Physical Access (PE-6)

SC-48Sensor Relocation (SC-48)

Threat Coverage(4 ATT&CK techniques)

T1053Scheduled Task/Job T1070Indicator Removal T1087Account Discovery T1114Email Collection

Cross-Framework Mappings(4)

PR.PS-04PR.PS-04Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20221 mappingFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule1 mappingFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

PR.PS-04PR.PS-04Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(4)

Assignmentorganization-defined event types

Assignmentorganization-defined event types (subset of AU-02_ODP[01])

Assignmentorganization-defined frequency or situation

Assignmentorganization-defined frequency

Control Enhancements(4)

AU-2(1)Compilation of Audit Records from Multiple Sources (AU-2(1))W

AU-2(2)Selection of Audit Events by Component (AU-2(2))W

AU-2(3)Reviews and Updates (AU-2(3))W

AU-2(4)Privileged Functions (AU-2(4))W

See Also

@SP 800-53 Overview ⚖Compare Baselines