AU-12 Audit Record Generation
Review AU-12
1. Set its parameters
No parameters to set for AU-12.
2. Record its status
a.Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [Assignment: organization-defined system components];
b.Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
c.Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3).
Discussion
Audit records can be generated from many different system components. The event types specified in [AU-2d](#au-2_smt.d) are the event types for which audit logs are to be generated and are a subset of all event types for which the system can generate audit records.
Enhancements
Review AU-12(1)
1. Set its parameters
No parameters to set for AU-12(1).
2. Record its status
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
Discussion
Audit trails are time-correlated if the time stamps in the individual audit records can be reliably related to the time stamps in other audit records to achieve a time ordering of the records within organizational tolerances.
Review AU-12(2)
1. Set its parameters
No parameters to set for AU-12(2).
2. Record its status
Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
Discussion
Audit records that follow common standards promote interoperability and information exchange between devices and systems. Promoting interoperability and information exchange facilitates the production of event information that can be readily analyzed and correlated. If logging mechanisms do not conform to standardized formats, systems may convert individual audit records into standardized formats when compiling system-wide audit trails.
Review AU-12(3)
1. Set its parameters
No parameters to set for AU-12(3).
2. Record its status
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].
Discussion
Permitting authorized individuals to make changes to system logging enables organizations to extend or limit logging as necessary to meet organizational requirements. Logging that is limited to conserve system resources may be extended (either temporarily or permanently) to address certain threat situations. In addition, logging may be limited to a specific set of event types to facilitate audit reduction, analysis, and reporting. Organizations can establish time thresholds in which logging actions are changed (e.g., near real-time, within minutes, or within hours).
Review AU-12(4)
1. Set its parameters
No parameters to set for AU-12(4).
2. Record its status
Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
Discussion
Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.
No Enhancements match this Baseline.