|

controlAU-6

Audit Record Review, Analysis, and Reporting (AU-6)

Review and analyze system audit records [organization-defined] for indications of [organization-defined] and the potential impact of the inappropriate or unusual activity; Report findings to [organization-defined] ; and Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Security Baselines

LOWMODERATEHIGH

auditaccountabilitylogging

Why These Connect

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports49

These related controls work together — a change to one may affect the others.

Mitigates2

This control helps defend against or reduce the risk of the linked threat technique.

Enhances10

These enhancements add specific capabilities or refinements to the base control.

Related Controls(39)

AC-7Unsuccessful Logon Attempts (AC-7)

AU-2Event Logging (AU-2)

AU-4Audit Log Storage Capacity (AU-4)

AC-2Account Management (AC-2)

AC-3Access Enforcement (AC-3)

AC-5Separation of Duties (AC-5)

AC-6Least Privilege (AC-6)

AC-17Remote Access (AC-17)

AU-7Audit Record Reduction and Report Generation (AU-7)

AU-16Cross-organizational Audit Logging (AU-16)CA-2Control Assessments (CA-2)

CA-7Continuous Monitoring (CA-7)

CM-2Baseline Configuration (CM-2)

CM-5Access Restrictions for Change (CM-5)

CM-6Configuration Settings (CM-6)

CM-10Software Usage Restrictions (CM-10)

CM-11User-installed Software (CM-11)

IA-2Identification and Authentication (Organizational Users) (IA-2)

IA-3Device Identification and Authentication (IA-3)

IA-5Authenticator Management (IA-5)

IA-8Identification and Authentication (Non-organizational Users) (IA-8)

IR-5Incident Monitoring (IR-5)

MA-4Nonlocal Maintenance (MA-4)

MP-4Media Storage (MP-4)

PE-3Physical Access Control (PE-3)

PE-6Monitoring Physical Access (PE-6)

RA-5Vulnerability Monitoring and Scanning (RA-5)

SA-8Security and Privacy Engineering Principles (SA-8)

SC-7Boundary Protection (SC-7)

SI-3Malicious Code Protection (SI-3)

SI-4System Monitoring (SI-4)

SI-7Software, Firmware, and Information Integrity (SI-7)

AU-9Protection of Audit Information (AU-9)

AU-11Audit Record Retention (AU-11)

AU-12Audit Record Generation (AU-12)

IR-4Incident Handling (IR-4)

PM-7Enterprise Architecture (PM-7)PM-12Insider Threat Program (PM-12)PM-31Continuous Monitoring Strategy (PM-31)

Threat Coverage(2 ATT&CK techniques)

T1136Create Account T1562Impair Defenses

Control Enhancements(10)

AU-6(1)Automated Process Integration (AU-6(1))

AU-6(2)Automated Security Alerts (AU-6(2))W

AU-6(3)Correlate Audit Record Repositories (AU-6(3))

AU-6(4)Central Review and Analysis (AU-6(4))

AU-6(5)Integrated Analysis of Audit Records (AU-6(5))

AU-6(6)Correlation with Physical Monitoring (AU-6(6))

AU-6(7)Permitted Actions (AU-6(7))

AU-6(8)Full Text Analysis of Privileged Commands (AU-6(8))

AU-6(9)Correlation with Information from Nontechnical Sources (AU-6(9))

AU-6(10)Audit Level Adjustment (AU-6(10))W

See Also

@SP 800-53 Overview ⚖Compare Baselines