---

id: "AU-03(01)" title: "Additional Audit Information" family: "AU" family_name: "Audit and Accountability" sort_id: "au-03.01" priority: "P2" implementation_level: "system" parent: "AU-03" enhancement: True

---

Statement

Generate audit records containing the following additional information: {{ insert: param, au-03.01_odp }}.

Guidance

The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records including, but not limited to, access control or flow control rules invoked and individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements. This facilitates the use of audit trails and audit logs by not including information in audit records that could potentially be misleading, make it more difficult to locate information of interest, or increase the risk to individuals' privacy.

Assessment Objective

generated audit records contain the following {{ insert: param, au-03.01_odp }}.

Audit and accountability policy

procedures addressing content of audit records

system security plan

privacy plan

system design documentation

system configuration settings and associated documentation

list of organization-defined auditable events

system audit records

other relevant documents or records

Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

system audit capability