initial training for new users, when required by system changes, and [Assignment: organization-defined frequency] thereafter. AT-3 The organization provides role-based security-related Security Training training: (i) before authorizing access to the system or performing assigned duties; (ii) when required by system changes; and (iii) [Assignment: frequency] thereafter. AT-4 The organization: Security Training Records Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and Retains individual training records for [Assignment: organization-defined time period]. Audit and Accountability AU-1 The organization develops, disseminates, and Audit and Accountability reviews/updates [Assignment: organization-defined Policy and Procedures frequency]: A Formal, documented audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. AU-2 The organization: The organization reviews and updates the list of Auditable Events Determines, on a risk assessment and auditable events [Assignment: organization-defined mission/business needs, that the information system frequency]. must be capable of auditing the following events: [Assignment: organization-defined list of auditable (4) The organization includes execution of privileged events]; functions in the list of events to be audited by the Coordinates the security audit function with other information system. organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; Provides a rationale for why the list of auditable events are deemed to be adequate to support investigations of security incidents; and Determines, based on current threat information and ongoing assessment of risk, that the following events are to be audited within the information system: [Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited along with the frequency of (or situation requiring) auditing for each identified event].
initial training for new users, when required by system changes, and [Assignment: organization-defined frequency] thereafter. AT-3 Security Training The organization provides role-based security-related training: (i) before authorizing access to the system or performing assigned duties; (ii) when required by system changes; and (iii) [Assignment: frequency] thereafter. AT-4 Security Training Records The organization: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and Retains individual training records for [Assignment: organization-defined time period]. Audit and Accountability AU-1 Audit and Accountability Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A Formal, documented audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. AU-2 Auditable Events The organization: Determines, on a risk assessment and mission/business needs, that the information system must be capable of auditing the following events: [Assignment: organization-defined list of auditable events]; Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; Provides a rationale for why the list of auditable events are deemed to be adequate to support investigations of security incidents; and Determines, based on current threat information and ongoing assessment of risk, that the following events are to be audited within the information system: [Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited along with the frequency of (or situation requiring) auditing for each identified event]. The organization reviews and updates the list of auditable events [Assignment: organization-defined frequency]. (4) The organization includes execution of privileged functions in the list of events to be audited by the information system.