---

id: "AU-12(04)" title: "Query Parameter Audits of Personally Identifiable Information" family: "AU" family_name: "Audit and Accountability" sort_id: "au-12.04" priority: "P2" implementation_level: "system" parent: "AU-12" enhancement: True

---

Statement

Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.

Guidance

Query parameters are explicit criteria that an individual or automated system submits to a system to retrieve data. Auditing of query parameters for datasets that contain personally identifiable information augments the capability of an organization to track and understand the access, usage, or sharing of personally identifiable information by authorized personnel.

Assessment Objective: the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;

Assessment Objective: the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.

Audit and accountability policy

system security plan

privacy plan

procedures addressing audit record generation

query event records

system design documentation

system configuration settings and associated documentation

map of system data actions

system audit records

other relevant documents or records

Organizational personnel with audit record generation responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Mechanisms implementing audit record generation capability