id: "AU-05(04)" title: "Shutdown on Failure" family: "AU" family_name: "Audit and Accountability" sort_id: "au-05.04" priority: "P2" implementation_level: "system" parent: "AU-05" enhancement: True
Statement
Invoke a {{ insert: param, au-05.04_odp.01 }} in the event of {{ insert: param, au-05.04_odp.02 }} , unless an alternate audit logging capability exists.
Guidance
Organizations determine the types of audit logging failures that can trigger automatic system shutdowns or degraded operations. Because of the importance of ensuring mission and business continuity, organizations may determine that the nature of the audit logging failure is not so severe that it warrants a complete shutdown of the system supporting the core organizational mission and business functions. In those instances, partial system shutdowns or operating in a degraded mode with reduced capability may be viable alternatives.
Assessment Objective
{{ insert: param, au-05.04_odp.01 }} is/are invoked in the event of {{ insert: param, au-05.04_odp.02 }} , unless an alternate audit logging capability exists.
Audit and accountability policy
procedures addressing response to audit processing failures
system design documentation
system security plan
privacy plan
system configuration settings and associated documentation
system audit records
other relevant documents or records
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
System capability invoking system shutdown or degraded operational mode in the event of an audit processing failure