id: "MA-04(01)" title: "Logging and Review" family: "MA" family_name: "Maintenance" sort_id: "ma-04.01" priority: "P2" implementation_level: "organization" parent: "MA-04" enhancement: True
Log {{ insert: param, ma-4.1_prm_1 }} for nonlocal maintenance and diagnostic sessions; and
Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
Guidance
Audit logging for nonlocal maintenance is enforced by AU-2 . Audit events are defined in AU-2a.
Assessment Objective: {{ insert: param, ma-04.01_odp.01 }} are logged for nonlocal maintenance sessions;
Assessment Objective: {{ insert: param, ma-04.01_odp.02 }} are logged for nonlocal diagnostic sessions;
Assessment Objective: the audit records of the maintenance sessions are reviewed to detect anomalous behavior;
Assessment Objective: the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.
Maintenance policy
procedures addressing nonlocal system maintenance
list of audit events
system configuration settings and associated documentation
maintenance records
diagnostic records
audit records
reviews of maintenance and diagnostic session records
system security plan
other relevant documents or records
Organizational personnel with system maintenance responsibilities
organizational personnel with information security responsibilities
organizational personnel with audit and review responsibilities
system/network administrators
Organizational processes for audit and review of nonlocal maintenance
mechanisms supporting and/or implementing audit and review of nonlocal maintenance