Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. AU-10 The information system protects against an Non-repudiation individual falsely denying having performed a particular action. AU-11 The organization retains audit records for [Assignment: Audit Record Retention organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. AU-12 The information system: (1) The information system compiles audit Audit Generation Provides audit record generation capability for the records from [Assignment: list of auditable events defined in AU-2 at information system components] [Assignment: organization-defined information into a system-wide (logical or physical) system components]; audit trail that is time correlated to within Allows designated organizational personnel to select [Assignment: organization-defined level of which auditable events are to be audited by specific tolerance for relationship between time components of the system; and stamps of individual records in the audit Generates audit records for the list of audited events trail]. defined in AU-2 with the content defined in AU-3. Security Assessment and Authorization CA-1 The organization develops, disseminates, and Security Assessment and reviews/updates [Assignment: organization-defined Authorization Policies and frequency]: Procedures Formal, documented security assessment and authorization policies that address purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls. CA-2 The organization: (1) The organization employs an independent assessor (2) The organization includes part of security Security Assessments Develops a security assessment plan that describes or assessment team to conduct an assessment of the control assessments, [Assignment: the scope of the assessment including: security controls in the information system. organization-defined frequency], Security controls and control enhancements [Selection: announced; unannounced], assessment; [Selection: in-depth monitoring; malicious Assessment procedures to be used to determine user testing; penetration testing; red team security control effectiveness; and exercises; [Assignme: Assessment environment, assessment team, other forms of security testing]]. and assessment roles and responsibilities; Assesses the security controls in the information system [Assignment: organization-defined
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. AU-10 Non-repudiation The information system protects against an individual falsely denying having performed a particular action. AU-11 Audit Record Retention The organization retains audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements. AU-12 Audit Generation The information system: Provides audit record generation capability for the list of auditable events defined in AU-2 at [Assignment: organization-defined information system components]; Allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and Generates audit records for the list of audited events defined in AU-2 with the content defined in AU-3. (1) The information system compiles audit records from [Assignment: information system components] into a system-wide (logical or physical) audit trail that is time correlated to within [Assignment: organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail]. Security Assessment and Authorization CA-1 Security Assessment and Authorization Policies and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: Formal, documented security assessment and authorization policies that address purpose, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the security assessment and authorization policies and associated security assessment and authorization controls. CA-2 Security Assessments The organization: Develops a security assessment plan that describes the scope of the assessment including: Security controls and control enhancements assessment; Assessment procedures to be used to determine security control effectiveness; and Assessment environment, assessment team, and assessment roles and responsibilities; Assesses the security controls in the information system [Assignment: organization-defined (1) The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system. (2) The organization includes part of security control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises; [Assignme: other forms of security testing]].