id: "AU-06(04)" title: "Central Review and Analysis" family: "AU" family_name: "Audit and Accountability" sort_id: "au-06.04" priority: "P2" implementation_level: "system" parent: "AU-06" enhancement: True
Statement
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Guidance
Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.
Assessment Objective: the capability to centrally review and analyze audit records from multiple components within the system is provided;
Assessment Objective: the capability to centrally review and analyze audit records from multiple components within the system is implemented.
Audit and accountability policy
procedures addressing audit review, analysis, and reporting
system design documentation
system configuration settings and associated documentation
system security plan
privacy plan
system audit records
other relevant documents or records
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
system developers
System capability to centralize review and analysis of audit records