id: "AU-09(07)" title: "Store on Component with Different Operating System" family: "AU" family_name: "Audit and Accountability" sort_id: "au-09.07" priority: "P2" implementation_level: "organization" parent: "AU-09" enhancement: True
Statement
Store audit information on a component running a different operating system than the system or component being audited.
Guidance
Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.
Assessment Objective
audit information is stored on a component running a different operating system than the system or component being audited.
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
Mechanisms implementing operating system verification capability
mechanisms verifying audit information storage location