AU-2 (3) AU-2 (3) High High The organization Automatically Moderate Moderate inspected/assessed is compliant Low Low automatically compliant with this CCI with this CCI because they because they are covered at the DoD are covered at level. the DoD level DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities. AU-2 (4) AU-2 (4) blank blank blank The organization NIST has not conducting the allocated this inspection/assessment AP. Therefore, reviews the organization's this AP is not audit and accountability applicable. policy; procedures addressing auditable events; list of organization defined auditable events; list of privileged security functions; other relevant documents or records. The objective is to validate the organization has included the execution of privileged functions in the list of events to be audited by the information system. AU-2 AU-2 (a) High High The organization Moderate Moderate conducting the Low Low inspection/assessment obtains and examines the documentation of the auditable events to ensure the information system is capable of auditing the: - successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. Classification levels), - Successful and unsuccessful logon attempts, - Privileged activities or other system level access, - Starting and ending time for user access to the system, - Concurrent logons from different workstations,
AU-2 (3) AU-2 (3) High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually or more frequently upon changes to situational awareness of threats or vulnerabilities. Automatically compliant with this CCI because they are covered at the DoD level AU-2 (4) AU-2 (4) blank blank blank The organization conducting the inspection/assessment reviews the organization's audit and accountability policy; procedures addressing auditable events; list of organization defined auditable events; list of privileged security functions; other relevant documents or records. The objective is to validate the organization has included the execution of privileged functions in the list of events to be audited by the information system. NIST has not allocated this AP. Therefore, this AP is not applicable. AU-2 AU-2 (a) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documentation of the auditable events to ensure the information system is capable of auditing the: - successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. Classification levels), - Successful and unsuccessful logon attempts, - Privileged activities or other system level access, - Starting and ending time for user access to the system, - Concurrent logons from different workstations,
RMF_Audit-and-Accountability-Plan.docx