---

id: "AU-09(03)" title: "Cryptographic Protection" family: "AU" family_name: "Audit and Accountability" sort_id: "au-09.03" priority: "P2" implementation_level: "system" parent: "AU-09" enhancement: True

---

Statement

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Guidance

Cryptographic mechanisms used for protecting the integrity of audit information include signed hash functions using asymmetric cryptography. This enables the distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Assessment Objective

cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.

Audit and accountability policy

system security plan

privacy plan

access control policy and procedures

procedures addressing protection of audit information

system design documentation

system hardware settings

system configuration settings and associated documentation

system audit records

other relevant documents or records

Organizational personnel with audit and accountability responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Cryptographic mechanisms protecting the integrity of audit information and tools