id: "AU-06(06)" title: "Correlation with Physical Monitoring" family: "AU" family_name: "Audit and Accountability" sort_id: "au-06.06" priority: "P2" implementation_level: "organization" parent: "AU-06" enhancement: True
Statement
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Guidance
The correlation of physical audit record information and the audit records from systems may assist organizations in identifying suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual’s identity for logical access to certain systems with the additional physical security information that the individual was present at the facility when the logical access occurred may be useful in investigations.
Assessment Objective
information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Audit and accountability policy
procedures addressing audit review, analysis, and reporting
procedures addressing physical access monitoring
system design documentation
system configuration settings and associated documentation
documentation providing evidence of correlated information obtained from audit records and physical access monitoring records
system security plan
privacy plan
other relevant documents or records
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with physical access monitoring responsibilities
organizational personnel with information security and privacy responsibilities
Mechanisms implementing the capability to correlate information from audit records with information from monitoring physical access